CVE-2023-39418

2023-08-1113:15:09

Google

osv.dev

postgresql

merge command

row security policies

update

select

software

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

0.001 Low

EPSS

Percentile

36.4%

JSON

A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

CPENameOperatorVersion
postgresqleq12.2-r1
postgresql14eq9.5.2-r3
postgresql15eq15.2-r2
postgresqleq12.1-r2
postgresqleq8.4.4-r0
postgresqleq11.3-r0
postgresqleq12.0-r1
postgresqleq12.2-r3
postgresqleq8.3.5-r0
postgresql14eq10.1-r1

Name	Operator	Version
postgresql	eq	12.2-r1
postgresql14	eq	9.5.2-r3
postgresql15	eq	15.2-r2
postgresql	eq	12.1-r2
postgresql	eq	8.4.4-r0
postgresql	eq	11.3-r0
postgresql	eq	12.0-r1
postgresql	eq	12.2-r3
postgresql	eq	8.3.5-r0
postgresql14	eq	10.1-r1