CVE-2023-2454

A flaw was found in PostgreSQL. Certain database calls could permit an attacker with elevated database-level privileges to execute arbitrary code.

The severity for Red Hat Enterprise Linux and Red Hat Software Collections has been set to Moderate because the vulnerability requires an attacker to have database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. As it requires a HIGH privileged user, it reduces the impact of this vulnerability.

Red Hat OpenShift Dev Spaces is not affected by this issue as PostgreSQL was decommissioned on the latest Red Hat OpenShift Dev Spaces 3.6 release, as described in: https://access.redhat.com/documentation/en-us/red_hat_openshift_dev_spaces/3.6/html/release_notes_and_known_issues/removed-functionalities#removed-functionality-crw-4105

Red Hat Satellite does not include the affected PostgreSQL, however, the component is shipped with Red Hat Enterprise Linux and consumed by Satellite. Red Hat Satellite users are advised to check the impact of Red Hat Enterprise Linux since any necessary fixes will also be distributed through it.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.