Описание
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
A flaw was found in PostgreSQL. This vulnerability, caused by type confusion in the 'portal'/cursor lifecycle, allows a user to execute arbitrary code as the operating system user running the database. This can occur by re-creating a cursor or other portal with different types. Successful exploitation could lead to a complete compromise of the database system.
Отчет
This is an Important vulnerability in PostgreSQL. A type confusion flaw in the cursor lifecycle allows a low-privileged authenticated database user to execute arbitrary code as the operating system user running the database. This can lead to a complete compromise of the database system, making it a significant risk in typical Red Hat deployments where PostgreSQL instances are exposed to authenticated users.
Меры по смягчению последствий
To mitigate this vulnerability, restrict direct database access strictly to trusted roles and minimize multi-tenant database scenarios where untrusted users can execute arbitrary SQL. Monitor database audit logs for anomalous or high-frequency cursor lifecycle activities involving unexpected CLOSE and DECLARE operations.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | postgresql | Out of support scope | ||
| Red Hat Hardened Images | postgresql17 | Not affected | ||
| Red Hat Hardened Images | postgresql18 | Not affected | ||
| Red Hat Enterprise Linux 10 | postgresql18 | Fixed | RHSA-2026:67280 | 14.09.2026 |
| Red Hat Enterprise Linux 10 | postgresql16 | Fixed | RHSA-2026:70186 | 22.09.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | postgresql16 | Fixed | RHSA-2026:72282 | 28.09.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | postgresql | Fixed | RHSA-2026:84585 | 19.10.2026 |
| Red Hat Enterprise Linux 8 | postgresql | Fixed | RHSA-2026:69876 | 22.09.2026 |
| Red Hat Enterprise Linux 8 | postgresql | Fixed | RHSA-2026:69923 | 22.09.2026 |
| Red Hat Enterprise Linux 8 | postgresql | Fixed | RHSA-2026:69924 | 23.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user t ...
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
EPSS
8.8 High
CVSS3