CVE-2023-39418: Postgresql: merge fails to enforce update or select row security policies
First published: Tue Aug 01 2023(Updated: )
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.
Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ubuntu/postgresql-15 | <15.4-1 | 15.4-1 |
| ubuntu/postgresql-15 | <15.4-0ubuntu0.23.04.1 | 15.4-0ubuntu0.23.04.1 |
| ubuntu/postgresql-15 | <15.4-1ubuntu1 | 15.4-1ubuntu1 |
| redhat/postgresql | <15.4 | 15.4 |
| PostgreSQL PostgreSQL | >=15.0<15.4 | |
| Redhat Enterprise Linux | =8.0 | |
| Redhat Enterprise Linux | =9.0 | |
| Debian Debian Linux | =12.0 | |
| debian/postgresql-11 | 11.16-0+deb10u1 11.22-0+deb10u2 | |
| debian/postgresql-13 | 13.13-0+deb11u1 13.14-0+deb11u1 | |
| debian/postgresql-15 | 15.5-0+deb12u1 15.6-0+deb12u1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=2228112
- https://access.redhat.com/security/cve/CVE-2023-39418
- https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229
- https://www.postgresql.org/support/security/CVE-2023-39418/
- https://security.netapp.com/advisory/ntap-20230915-0002/
- https://access.redhat.com/errata/RHSA-2023:7785
- https://www.debian.org/security/2023/dsa-5553
- https://access.redhat.com/errata/RHSA-2023:7883
- https://access.redhat.com/errata/RHSA-2023:7884
- https://access.redhat.com/errata/RHSA-2023:7885
- https://launchpad.net/bugs/cve/CVE-2023-39418
- https://www.postgresql.org/support/security/CVE-2023-39418
- https://www.postgresql.org/about/news/postgresql-154-149-1312-1216-1121-and-postgresql-16-beta-3-released-2689/
- https://security-tracker.debian.org/tracker/CVE-2023-39418
- https://exchange.xforce.ibmcloud.com/vulnerabilities/263358
- https://www.ibm.com/support/pages/node/7145492 (Advisory)
- https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 (REL_15_4)
- https://ubuntu.com/security/notices/USN-6296-1
- https://www.cve.org/CVERecord?id=CVE-2023-39418
- https://nvd.nist.gov/vuln/detail/CVE-2023-39418
- https://ubuntu.com/security/CVE-2023-39418
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-39418.
What is the severity level of CVE-2023-39418?
The severity level of CVE-2023-39418 is medium (4.3).
What is the affected software of CVE-2023-39418?
The affected software of CVE-2023-39418 is PostgreSQL version 15.4 and below on Redhat Enterprise Linux 8.0 and 9.0, and PostgreSQL versions 11, 13, and 15 on Debian and Ubuntu.
What is the description of CVE-2023-39418?
CVE-2023-39418 is a vulnerability in PostgreSQL that occurs when using the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT, potentially allowing a user to store forbidden rows.
Are there any references for CVE-2023-39418?
Yes, you can find references for CVE-2023-39418 at these links: [reference 1](https://bugzilla.redhat.com/show_bug.cgi?id=2228112), [reference 2](https://access.redhat.com/security/cve/CVE-2023-39418), and [reference 3](https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229).
- agent/type
- agent/remedy
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-39418
- agent/software-canonical-lookup
- agent/title
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/nvd-cve
- collector/ibm-support
- source/IBM
- agent/last-modified-date
- agent/references
- agent/severity
- agent/tags
- agent/description
- agent/event
- collector/usn-cve
- source/Ubuntu
- package-manager/redhat
- vendor/postgresql
- canonical/postgresql postgresql
- version/postgresql postgresql/15.0
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- version/redhat enterprise linux/9.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/12.0
- package-manager/debian
- package-manager/ubuntu