PT-2016-1648 · Postgresql · Postgresql

Stephen Frost · Published 2016-03-31 · Updated 2025-02-11 · CVE-2016-2193

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 9.5.2

Description The issue is related to errors in security settings, allowing a remote attacker to bypass existing access restrictions by leveraging a session that performs queries as more than one role. This is due to the improper maintenance of row-security status in cached plans.

Recommendations For versions prior to 9.5.2, update to version 9.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to roles that perform queries as more than one role to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2016-00974

CVE-2016-2193

MGASA-2016-0136

OPENSUSE-SU-2024:10273-1

Affected Products

Postgresql

References · 59

• https://bdu.fstec.ru/vul/2016-00974 · Security Note
• https://osv.dev/vulnerability/CVE-2016-2193 · Vendor Advisory
• http://postgresql.org/docs/current/static/release-9-5-2.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2193 · Security Note
• http://postgresql.org/about/news/1656 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0136.html · Security Note
• https://osv.dev/vulnerability/MGASA-2016-0136 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10273-1 · Vendor Advisory
• http://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=db69e58a0642ef7fa46d62f6c4cf2460c3a1b41b · Note
• https://bugs.mageia.org/show_bug.cgi?id=18103 · Note
• https://suse.com/security/cve/CVE-2014-0063 · Note
• https://suse.com/security/cve/CVE-2007-6600 · Note
• https://suse.com/security/cve/CVE-2014-0062 · Note
• https://suse.com/security/cve/CVE-2016-3065 · Note
• https://suse.com/security/cve/CVE-2016-0766 · Note