CVE-2023-39418
Summary
| CVE | CVE-2023-39418 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-08-11 13:15:00 UTC |
| Updated | 2023-11-14 14:15:00 UTC |
| Description | A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Postgresql | Postgresql | All | All | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 9.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| cve-details | MISC | access.redhat.com | |
| PostgreSQL: CVE-2023-39418: MERGE fails to enforce UPDATE or SELECT row security policies | MISC | www.postgresql.org | |
| git.postgresql.org Git - postgresql.git/commitdiff | MISC | git.postgresql.org | |
| August 2023 PostgreSQL Vulnerabilities in NetApp Products | NetApp Product Security | MISC | security.netapp.com | |
| Debian -- Security Information -- DSA-5553-1 postgresql-15 | www.debian.org | ||
| 2228112 – (CVE-2023-39418) CVE-2023-39418 postgresql: MERGE fails to enforce UPDATE or SELECT row security policies | MISC | bugzilla.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 161232 Oracle Enterprise Linux Security Update for postgresql:15 (ELSA-2023-7785)
- 161253 Oracle Enterprise Linux Security Update for postgresql:15 (ELSA-2023-7884)
- 199665 Ubuntu Security Notification for PostgreSQL Vulnerabilities (USN-6296-1)
- 242614 Red Hat Update for postgresql:15 (RHSA-2023:7785)
- 242634 Red Hat Update for postgresql:15 (RHSA-2023:7885)
- 242636 Red Hat Update for postgresql:15 (RHSA-2023:7883)
- 242657 Red Hat Update for postgresql:15 (RHSA-2023:7884)
- 356538 Amazon Linux Security Advisory for postgresql15 : ALAS2023-2023-387
- 503280 Alpine Linux Security Update for postgresql
- 503281 Alpine Linux Security Update for postgresql13
- 503282 Alpine Linux Security Update for postgresql14
- 503283 Alpine Linux Security Update for postgresql12
- 503284 Alpine Linux Security Update for postgresql15
- 505920 Alpine Linux Security Update for postgresql15
- 506163 Alpine Linux Security Update for postgresql13
- 506165 Alpine Linux Security Update for postgresql14
- 6000322 Debian Security Update for postgresql-15 (DSA 5553-1)
- 691229 Free Berkeley Software Distribution (FreeBSD) Security Update for postgresql (59a43a73-3786-11ee-94b4-6cc21735f730)
- 754278 SUSE Enterprise Linux Security Update for postgresql15 (SUSE-SU-2023:3342-1)
- 941510 AlmaLinux Security Update for postgresql:15 (ALSA-2023:7785)
- 941512 AlmaLinux Security Update for postgresql:15 (ALSA-2023:7884)