Уязвимость DoS атаки в PostgreSQL через роль "pg_cancel_backend", влияющую на фоновые процессы
Описание
В PostgreSQL обнаружена уязвимость, связанная с ролью pg_cancel_backend, которая отправляет сигналы фоновым процессам, включая логический репликатор (logical replication launcher), автовакуумные рабочие процессы (autovacuum workers) и автовакуумный запускатель (autovacuum launcher). Успешная эксплуатация требует наличия стороннего расширения с менее устойчивым фоновым процессом и затрагивает только этот конкретный фоновый процесс. Данная проблема может позволить удалённому пользователю с высокими привилегиями инициировать атаку отказа в обслуживании (DoS).
Тип уязвимости
DoS атака (Denial of Service)
Ссылки
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Одно из
Одно из
EPSS
2.2 Low
CVSS3
4.4 Medium
CVSS3
Дефекты
Связанные уязвимости
A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.
A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.
A flaw was found in PostgreSQL involving the pg_cancel_backend role th ...
A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.
EPSS
2.2 Low
CVSS3
4.4 Medium
CVSS3