CVE-2023-41119 - EDB Postgres Advanced Server (EPAS) dbms_aq helper function may run arbitrary SQL as a superuser

Suggest edits

First Published: 2023/08/21

Last Updated: 2023/08/30

Summary

An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contains the function _dbms_aq_move_to_exception_queue that may be used to elevate a user's privileges to superuser. This function accepts the OID of a table, and then accesses that table as the superuser by using SELECT and DML commands.

Vulnerability details

CVE-ID: CVE-2023-41119

CVSS Base Score: 8.8

CVSS Temporal Score: Undefined

CVSS Environmental Score: Undefined

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products and versions

EnterpriseDB Postgres Advanced Server (EPAS)

  • All versions prior to 11.21.32
  • All versions prior to 12.16.20
  • All versions prior to 13.12.17
  • All versions prior to 14.9.0
  • All versions prior to 15.4.0

Remediation/fixes

Impacted users must upgrade to a fixed version of EPAS and then patch existing database instance clusters using edb_sqlpatch. Users running unsupported versions of EPAS should upgrade to receive these updates. For questions about updating, users can contact their account representative or contact EDB.

ProductVRMFRemediation/First Fix
EPASAll versions prior to 11.21.32Update to latest supported version
(at least 11.21.32) and patch existing clusters.
EPASAll versions prior to 12.16.20Update to latest supported version
(at least 12.16.20) and patch existing clusters.
EPASAll versions prior to 13.12.17Update to latest supported version
(at least 13.12.17) and patch existing clusters.
EPASAll versions prior to 14.9.0Update to latest supported version
(at least 14.9.0) and patch existing clusters.
EPASAll versions prior to 15.4.0Update to latest supported version
(at least 15.4.0) and patch existing clusters.
Update

30 Aug 2023 - Added recommendation to Remediation to patch existing clusters

Warning:

The patch modifies the definitions of system objects inside the database, some behavioral differences may be noticeable after applying fixes. Affected users should confirm whether any of the provided fixes are likely to affect applications running against the database prior to applying them.

References

Related information

Acknowledgement

EnterpriseDB

Change history

  • 21 August 2023: Original Copy Published
  • 28 August 2023: Updated with assigned CVE number
  • 30 August 2023: Updated with Remediation to patch existing clusters

Disclaimer

This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document is at your own risk. EDB reserves the right to change or update this document at any time. Customers are therefore recommended to always view the latest version of this document.

Could this page be better? Report a problem or suggest an addition!