Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-plperlUpgrade postgresql-plpython3Upgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-private-libsUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-private-develUpgrade postgresql-serverUpgrade postgresql-staticUpgrade pg_repackUpgrade postgresql-upgrade-develUpgrade postgresql-docsUpgrade pgauditUpgrade postgres-decoderbufsUpgrade postgresql-contrib | Jun 27, 2023 | Jun 9, 2023 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql13Upgrade postgresqlUpgrade postgresql14Upgrade postgresql12 | Mar 26, 2024 | Jun 9, 2023 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-plpython2Upgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-serverUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-llvmjitUpgrade postgresql-testUpgrade postgresql-test-rpm-macrosUpgrade postgresql-private-libsUpgrade postgresql-server-develUpgrade postgresql-staticUpgrade postgresql-private-develUpgrade postgresql-docsUpgrade postgresql-upgrade-develUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade postgresql-devel | Sep 28, 2023 | Jun 9, 2023 |
| Amazon_linux_2023 | — | Upgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-pltclUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-testUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-contribUpgrade postgresql15-test-debuginfoUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-plpython3Upgrade postgresql15-docsUpgrade postgresql15-serverUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-private-libsUpgrade postgresql15-debugsourceUpgrade postgresql15-staticUpgrade postgresql15-private-develUpgrade postgresql15-llvmjitUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql15-upgrade-develUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-debuginfoUpgrade postgresql15-plperlUpgrade postgresql15Upgrade postgresql15-server-develUpgrade postgresql15-server-debuginfo | Feb 17, 2025 | May 11, 2023 |
| Centos_linux | — | Upgrade pg_repack-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-plperlUpgrade pg_repackUpgrade postgresql-debugsourceUpgrade postgresql-serverUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-server-develUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-docs-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-private-develUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade pgauditUpgrade postgresql-upgrade-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-staticUpgrade pg_repack-debugsourceUpgrade postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade pgaudit-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-contrib-debuginfo | Jun 22, 2023 | Jun 9, 2023 |
| Debian | — | Upgrade postgresql-13Upgrade postgresql-15 | May 15, 2023 | May 15, 2023 |
| Dell Powerstore Dsa2023366 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 5, 2023 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | May 11, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-plpythonUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql | Jan 10, 2024 | Jun 9, 2023 |
| Oracle_linux | — | Upgrade postgresqlUpgrade postgresql-private-libsUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgresql-test-rpm-macrosUpgrade postgresql-private-develUpgrade postgresql-plperlUpgrade pg_repackUpgrade postgresql-docs | Jun 22, 2023 | May 11, 2023 |
| Postgres | — | Upgrade to PostgreSQL version 14.8Upgrade to PostgreSQL version 15.3 | Jun 9, 2023 | Jun 9, 2023 |
| Redhat_linux | — | Upgrade postgresql-contribUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-staticUpgrade postgresql-contrib-debuginfoUpgrade postgresql-pltclUpgrade postgresql-upgrade-develUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-docsUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-debuginfoUpgrade postgres-decoderbufsUpgrade pg_repackUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-testUpgrade postgresqlUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-server-develNo solution existsUpgrade postgresql-private-libsUpgrade postgresql-debugsourceUpgrade postgresql-server-debuginfoUpgrade postgresql-private-develUpgrade pg_repack-debuginfoUpgrade postgresql-docs-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-plperlUpgrade pgauditUpgrade pg_repack-debugsourceUpgrade pgaudit-debuginfo | Jun 22, 2023 | Jun 9, 2023 |
| Rocky_linux | — | Upgrade postgresql-upgrade-debuginfoUpgrade postgresql-staticUpgrade postgresql-debugsourceUpgrade postgresql-pltclUpgrade postgresql-private-libsUpgrade postgresql-server-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-test-debuginfoUpgrade pg_repackUpgrade postgresql-testUpgrade postgresql-docs-debuginfoUpgrade postgresql-docsUpgrade pgaudit-debugsourceUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-devel-debuginfoUpgrade pg_repack-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade pgauditUpgrade pg_repack-debugsourceUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-upgradeUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plpython3Upgrade postgres-decoderbufs-debuginfoUpgrade postgresql-contribUpgrade postgresql-private-devel | Mar 5, 2024 | Jun 9, 2023 |
| Suse | — | Upgrade postgresql12-pltclUpgrade postgresql13-plpythonUpgrade postgresql12-docsUpgrade postgresql14-plpythonUpgrade postgresql13-testUpgrade postgresql15-docsUpgrade libpq5-32bitUpgrade postgresql14-llvmjitUpgrade libecpg6Upgrade postgresql13-docsUpgrade postgresql14Upgrade postgresql14-plperlUpgrade postgresql14-contribUpgrade postgresql14-develUpgrade postgresql15-llvmjitUpgrade postgresql15-serverUpgrade postgresql12-serverUpgrade postgresql15-server-develUpgrade postgresql15-plperlUpgrade postgresql12-server-develUpgrade postgresql12-testUpgrade postgresql12-contribUpgrade postgresql13-contribUpgrade postgresql13-develUpgrade postgresql15-develUpgrade postgresql12-plperlUpgrade postgresql15Upgrade postgresql15-testUpgrade postgresql12Upgrade libecpg6-32bitUpgrade postgresql14-server-develUpgrade postgresql13-serverUpgrade postgresql15-llvmjit-develUpgrade postgresql14-llvmjit-develUpgrade postgresql13Upgrade postgresql15-pltclUpgrade postgresql15-plpythonUpgrade postgresql14-serverUpgrade postgresql13-llvmjitUpgrade postgresql12-llvmjit-develUpgrade postgresql12-llvmjitUpgrade postgresql15-contribUpgrade postgresql12-plpythonUpgrade postgresql14-testUpgrade postgresql13-plperlUpgrade postgresql13-llvmjit-develUpgrade postgresql14-pltclUpgrade postgresql13-server-develUpgrade postgresql12-develUpgrade libpq5Upgrade postgresql13-pltclUpgrade postgresql14-docs | May 16, 2023 | May 15, 2023 |
| Ubuntu | — | Upgrade postgresql-client-12Upgrade postgresql-client-10Upgrade postgresql-client-14Upgrade postgresql-14Upgrade postgresql-10Upgrade postgresql-12Upgrade postgresql-15Upgrade postgresql-client-15 | May 25, 2023 | May 24, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub