CVE-2023-2455: 
PostgreSQL vulnerability analysis and mitigation

CVE-2023-2455 is a security vulnerability in PostgreSQL that affects databases using row security policies. The vulnerability was discovered and reported by Wolfgang Walther, with fixes released on May 11, 2023. The issue occurs when role-specific policies are used and a query is planned under one role but executed under different roles, which can happen in security definer functions or when queries are re-used across multiple SET ROLEs (PostgreSQL Security).

The vulnerability stems from an incomplete fix of CVE-2016-2193, specifically in scenarios involving function inlining. When a query is planned under one role and executed under different roles, the row security policies may be incorrectly applied. This affects only databases that have implemented row security policies using CREATE POLICY. The vulnerability has been assigned a CVSS 3.1 base score of 5.4 (Medium) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (NVD).

When exploited, this vulnerability could allow users to perform otherwise-forbidden read and modify operations on database rows. The impact is limited to databases that have specifically implemented row security policies, potentially compromising the intended access controls (PostgreSQL Security).

Fixed versions were released on May 11, 2023, with patches available in PostgreSQL versions 15.3, 14.8, 13.11, 12.15, and 11.20. Users should upgrade to these or later versions to address the vulnerability (PostgreSQL Security).