Описание
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
A flaw was found in PostgreSQL where missing authorization checks in DDL commands allow an authenticated user to create unauthorized dependencies on a data type (such as when assigning a range subtype or referencing the type in an SQL expression). This allows the user to block legitimate owners from altering or dropping that type, resulting in a targeted denial-of-service condition on the affected database object.
Отчет
This Moderate impact flaw allows an authenticated user with object creation rights to cause a targeted denial of service in PostgreSQL. Missing authorization checks during specific DDL operations allow an attacker to create type dependencies that block legitimate ALTER and DROP commands, preventing routine administrative management of affected data types.
Меры по смягчению последствий
To mitigate this vulnerability, administrators can proactively monitor for and manually remove unauthorized dependencies created on composite types by users lacking USAGE privileges. Restricting database access and object creation rights only to trusted users will limit the exposure.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | postgresql16 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | postgresql18 | Fix deferred | ||
| Red Hat Enterprise Linux 6 | postgresql | Not affected | ||
| Red Hat Enterprise Linux 7 | postgresql | Fix deferred | ||
| Red Hat Enterprise Linux 8 | postgresql:12/postgresql | Fix deferred | ||
| Red Hat Enterprise Linux 8 | postgresql:15/postgresql | Fix deferred | ||
| Red Hat Enterprise Linux 8 | postgresql:16/postgresql | Fix deferred | ||
| Red Hat Enterprise Linux 9 | postgresql | Fix deferred | ||
| Red Hat Enterprise Linux 9 | postgresql:15/postgresql | Fix deferred | ||
| Red Hat Enterprise Linux 9 | postgresql:16/postgresql | Fix deferred |
Показывать по
Дополнительная информация
Статус:
4.3 Medium
CVSS3
Связанные уязвимости
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Missing authorization in PostgreSQL DDL commands allows an object crea ...
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
4.3 Medium
CVSS3