Postgresql: role pg_signal_backend can signal certain superuser processes.

Summary

A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.

Timeline

1. Dec 10, 2023, 5:58 PM UTCCVE published
2. Dec 19, 2023, 7:42 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Mar 2, 2026, 5:25 PM UTCRecord last updated

Affected versions

• advanced-cluster-security/rhacs-central-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-main-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-operator-bundle

  Version range not reported

• advanced-cluster-security/rhacs-scanner-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-db-slim-rhel8

  Version range not reported

• postgresql:13

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:15

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:13

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:13

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:13

  Version range not reported

• postgresql:13

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:13

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:15

  Version range not reported

• postgresql

  Version range not reported

• postgresql:15

  Version range not reported

• postgresql

  Version range not reported

• postgresql

  Version range not reported

• postgresql:15

  Version range not reported

• rh-postgresql12-postgresql

  Version range not reported

• rh-postgresql13-postgresql

  Version range not reported

• advanced-cluster-security/rhacs-central-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-main-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-operator-bundle

  Version range not reported

• advanced-cluster-security/rhacs-scanner-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-db-slim-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-central-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-main-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-operator-bundle

  Version range not reported

• advanced-cluster-security/rhacs-scanner-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-db-slim-rhel8

  Version range not reported

• postgresql

  Version range not reported

• postgresql

  Version range not reported

• postgresql:10/postgresql

  Version range not reported

• postgresql:16/postgresql

  Version range not reported

• postgresql:16/postgresql

  Version range not reported

• rh-postgresql10-postgresql

  Version range not reported

References 25