一、漏洞信息
漏洞编号：CVE-2024-10976
漏洞归属组件：postgresql
漏洞归属的版本：10.23,10.5,13.11,13.12,13.13,13.3,14.8,15.4,15.5,15.6,42.2.14
CVSS V3.0分值：
BaseScore：4.2 Medium
Vector：CVSS：3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
漏洞简述：
Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. An attacker must tailor an attack to a particular application s pattern of query plan reuse, user ID changes, and role-specific row security policies. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
漏洞公开时间：2024-11-14 21:15:03
漏洞创建时间：2024-11-14 21:44:59
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2024-10976

漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：

二、漏洞分析结构反馈
影响性分析说明：
Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs.
openEuler评分：
4.2
Vector：CVSS：3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
受影响版本排查(受影响/不受影响)：
1.master(15.6):受影响
2.openEuler-22.03-LTS-SP1(13.12):受影响
3.openEuler-22.03-LTS-SP3(13.13):受影响
4.openEuler-22.03-LTS-SP4(13.13):受影响
5.openEuler-24.03-LTS(15.6):受影响
6.openEuler-24.03-LTS-Next(15.6):受影响
7.openEuler-24.03-LTS-SP1:受影响
8.openEuler-20.03-LTS-SP4(10.23):不受影响

修复是否涉及abi变化(是/否)：
1.master(15.6):否
2.openEuler-20.03-LTS-SP4(10.23):否
3.openEuler-22.03-LTS-SP1(13.12):否
4.openEuler-22.03-LTS-SP3(13.13):否
5.openEuler-22.03-LTS-SP4(13.13):否
6.openEuler-24.03-LTS(15.6):否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-Next(15.6):否

原因说明：
1.master(15.6):正常修复
2.openEuler-22.03-LTS-SP1(13.12):正常修复
3.openEuler-22.03-LTS-SP3(13.13):正常修复
4.openEuler-22.03-LTS-SP4(13.13):正常修复
5.openEuler-24.03-LTS(15.6):正常修复
6.openEuler-24.03-LTS-Next(15.6):正常修复
7.openEuler-24.03-LTS-SP1:正常修复
8.openEuler-20.03-LTS-SP4(10.23):不受影响-组件不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2469