KLA52240 RCE vulnerability in PostgreSQL

Remote code execution vulnerability was found in PostgreSQL. Malicious users can exploit this vulnerability to execute arbitrary code.

Original advisories

PostgreSQL: CVE-2023-39417: Extension script @substitutions@ within quoting allow SQL injection

Related products

PostgreSQL

CVE list

CVE-2023-39417 critical

Solution

Update to the latest version

Download PostgreSQL

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• PostgreSQL 15.x earlier than 15.4PostgreSQL 14.x earlier than 14.9PostgreSQL 13.x earlier than 13.12PostgreSQL 12.x earlier than 12.16PostgreSQL 11.x earlier than 11.21