Denial of Service in PostgreSQL via Missing Authorization in DDL Commands

Executive Summary

This vulnerability in PostgreSQL involves missing authorization checks during Data Definition Language (DDL) commands. An object creator can exploit this by creating a dependency on a type, leading to denial of service when attempting to ALTER or DROP the type. Affected versions are those before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the PostgreSQL version using 'psql --version' or 'SELECT version();'. If the version is below 18.5, 17.11, 16.15, 15.19, or 14.24, the system is vulnerable. Review DDL operations involving type creation and dependencies.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker with object creation privileges to disrupt database operations by preventing the modification or deletion of types. This can lead to system downtime or degraded performance, particularly if critical types are targeted.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts availability by enabling denial of service attacks on PostgreSQL type operations. While it does not directly expose data or violate confidentiality, it could disrupt database operations critical for compliance with standards like GDPR or HIPAA that require reliable data access and processing.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade PostgreSQL to version 18.5, 17.11, 16.15, 15.19, or 14.24 or later. Ensure proper USAGE privilege checks are enforced for all DDL operations involving types.

Useful 0 Not Useful 0