CVE-2024-10976

Nov. 15, 2024, 1:58 p.m.

4.2
Medium

Description

Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. An attacker must tailor an attack to a particular application's pattern of query plan reuse, user ID changes, and role-specific row security policies. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

Product(s) Impacted

Product Versions
PostgreSQL
  • ['before 17.1', 'before 16.5', 'before 15.9', 'before 14.14', 'before 13.17', 'before 12.21']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-1250
Improper Preservation of Consistency Between Independent Representations of Shared State
The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other.

References

https://www.postgresql.org/support/security/CVE-2024-10976/

Tags

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
2024-11-14
CVE-2024-10976
CWE-1250

CVSS Score

4.2 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: HIGH
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: LOW
  • Integrity Impact: LOW
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

    View Vector String

Timeline

Published: Nov. 14, 2024, 1:15 p.m.
Last Modified: Nov. 15, 2024, 1:58 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.