IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:…@ inside a quoting construct (dollar quoting, ‘’, or “”). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

OSVersionArchitecturePackageVersionFilename
Debian10allpostgresql-11< 11.21-0+deb10u2postgresql-11_11.21-0+deb10u2_all.deb
Debian11allpostgresql-13< 13.13-0+deb11u1postgresql-13_13.13-0+deb11u1_all.deb
Debian12allpostgresql-15< 15.5-0+deb12u1postgresql-15_15.5-0+deb12u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	postgresql-11	< 11.21-0+deb10u2	postgresql-11_11.21-0+deb10u2_all.deb
Debian	11	all	postgresql-13	< 13.13-0+deb11u1	postgresql-13_13.13-0+deb11u1_all.deb
Debian	12	all	postgresql-15	< 15.5-0+deb12u1	postgresql-15_15.5-0+deb12u1_all.deb