CVEvulnerability
CVE-2023-39418
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-08-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 3.1 LOW — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-1220
Description
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.
Affected configurations
• postgresql postgresql (>= 15.0 < 15.4)
• redhat enterprise linux 8.0
• redhat enterprise linux 9.0
• debian debian linux 12.0
Related
Weakness · CWE (1)
- CWE-1220 Insufficient Granularity of Access Control weakness
References
- https://access.redhat.com/errata/RHSA-2023:7785 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:7883 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:7884 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:7885 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-39418 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2228112 Issue Tracking, Patch, Third Party Advisory
- https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 Mailing List, Patch
- https://www.postgresql.org/support/security/CVE-2023-39418/ Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:7785 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:7883 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:7884 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:7885 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-39418 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2228112 Issue Tracking, Patch, Third Party Advisory
- https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 Mailing List, Patch
- https://security.netapp.com/advisory/ntap-20230915-0002/ security.netapp.com
- https://www.debian.org/security/2023/dsa-5553 www.debian.org
- https://www.postgresql.org/support/security/CVE-2023-39418/ Vendor Advisory