Vulnerability CVE-2023-39418: Information

Description

A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

Severity: MEDIUM (4.3) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-39418

Published: Aug. 11, 2023

Modified: Feb. 16, 2024

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
postgresql15	sisyphus	15.4-alt1	15.6-alt1	ALT-PU-2023-4805-1	326806	Fixed
postgresql15	sisyphus_e2k	15.4-alt1	15.6-alt1	ALT-PU-2023-4836-1	-	Fixed
postgresql15	sisyphus_riscv64	15.4-alt2	15.6-alt1	ALT-PU-2023-4913-1	-	Fixed
postgresql15	p10	15.4-alt0.p10.1	15.6-alt0.p10.1	ALT-PU-2023-4815-2	326814	Fixed
postgresql15	p10_e2k	15.4-alt0.p10.1	15.6-alt0.p10.1	ALT-PU-2023-4990-1	-	Fixed
postgresql15	c10f1	15.4-alt0.p10.1	15.6-alt0.c10.1	ALT-PU-2023-5633-3	329540	Fixed
postgresql15-1C	sisyphus	15.3-alt3	15.5-alt4	ALT-PU-2023-4810-1	326806	Fixed
postgresql15-1C	sisyphus_e2k	15.3-alt3	15.5-alt4	ALT-PU-2023-4841-1	-	Fixed
postgresql15-1C	sisyphus_riscv64	15.4-alt1	15.5-alt4	ALT-PU-2023-5178-1	-	Fixed
postgresql15-1C	p10	15.3-alt0.p10.2	15.5-alt0.p10.3	ALT-PU-2023-4814-2	326814	Fixed
postgresql15-1C	p10_e2k	15.3-alt0.p10.2	15.5-alt0.p10.3	ALT-PU-2023-4995-1	-	Fixed
postgresql15-1C	c10f1	15.4-alt0.p10.1	15.5-alt0.p10.3	ALT-PU-2023-5637-3	329540	Fixed

References to Advisories, Solutions, and Tools

Hyperlink	Resource
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229	Mailing List Patch
https://access.redhat.com/security/cve/CVE-2023-39418	Third Party Advisory
https://www.postgresql.org/support/security/CVE-2023-39418/	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2228112	Issue Tracking Patch Third Party Advisory
https://security.netapp.com/advisory/ntap-20230915-0002/	Third Party Advisory
https://www.debian.org/security/2023/dsa-5553	Third Party Advisory
RHSA-2023:7785	Third Party Advisory
RHSA-2023:7883	Third Party Advisory
RHSA-2023:7884	Third Party Advisory
RHSA-2023:7885	Third Party Advisory

Affected configurations:
1. Configuration 1
  cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
  Start including
  15.0
  End excliding
  15.4
  
  Configuration 2
  cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
  
  Configuration 3
  cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

Version: v24.5.0

Vulnerability CVE-2023-39418: Information

Description

Fixed packages

References to Advisories, Solutions, and Tools

Configuration 1

Configuration 2

Configuration 3