IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-develUpgrade pg_repackUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-private-develUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-plpython3Upgrade postgresql-private-libsUpgrade postgresql-serverUpgrade pgauditUpgrade postgres-decoderbufs | Dec 5, 2023 | Aug 11, 2023 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql13Upgrade postgresql14Upgrade postgresqlUpgrade postgresql12 | Aug 22, 2024 | Aug 11, 2023 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-pltclUpgrade postgresql-llvmjitUpgrade postgresql-plpython2Upgrade postgresql-contribUpgrade postgresql-plpython3Upgrade postgresql-debuginfoUpgrade postgresql-docsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-private-develUpgrade postgresql-upgradeUpgrade postgresql-upgrade-develUpgrade postgresql-plperlUpgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql-private-libsUpgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql | Sep 28, 2023 | Aug 11, 2023 |
| Amazon_linux_2023 | — | Upgrade postgresql15-test-rpm-macrosUpgrade postgresql15-private-develUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-staticUpgrade postgresql15-test-debuginfoUpgrade postgresql15-plperlUpgrade postgresql15-debuginfoUpgrade postgresql15-llvmjitUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15Upgrade postgresql15-testUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-private-libsUpgrade postgresql15-server-debuginfoUpgrade postgresql15-pltclUpgrade postgresql15-contribUpgrade postgresql15-debugsourceUpgrade postgresql15-server-develUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql15-docsUpgrade postgresql15-serverUpgrade postgresql15-upgrade-develUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-plpython3Upgrade postgresql15-docs-debuginfo | Feb 17, 2025 | Aug 10, 2023 |
| Centos_linux | — | Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-serverUpgrade pg_repack-debugsourceUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgres-decoderbufsUpgrade postgresql-contrib-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade pgauditUpgrade postgresql-staticUpgrade postgresql-test-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-private-develUpgrade pg_repack-debuginfoUpgrade postgresql-server-develUpgrade postgresql-server-debuginfoUpgrade postgresql-upgradeUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-plperlUpgrade pgaudit-debuginfoUpgrade postgresql-plpython3Upgrade pgaudit-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade pg_repack | Nov 30, 2023 | Aug 11, 2023 |
| Debian | — | Upgrade postgresql-15Upgrade postgresql-13Upgrade pgextwlist | Oct 5, 2023 | Aug 11, 2023 |
| Freebsd | — | Upgrade postgresql-server | Aug 11, 2023 | Aug 10, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-test | Jan 10, 2024 | Aug 11, 2023 |
| Oracle_linux | — | Upgrade postgresql-serverUpgrade postgresql-plperlUpgrade pgauditUpgrade pg_repackUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-private-develUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgres-decoderbufsUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-private-libsUpgrade postgresql-plpython3Upgrade postgresql-testUpgrade postgresqlUpgrade postgresql-upgrade | Dec 1, 2023 | Aug 10, 2023 |
| Postgres | — | Upgrade to PostgreSQL version 14.9Upgrade to PostgreSQL version 15.4 | Aug 11, 2023 | Aug 11, 2023 |
| Redhat_linux | — | Upgrade postgresql-staticUpgrade postgresql-contrib-debuginfoUpgrade postgresqlUpgrade postgresql-private-develNo solution existsUpgrade postgresql-upgrade-develUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-test-debuginfoUpgrade pgauditUpgrade pg_repack-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-testUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-docsUpgrade postgresql-private-libs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade pgaudit-debugsourceUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-docs-debuginfoUpgrade pg_repackUpgrade postgresql-plpython3Upgrade postgresql-upgrade-devel-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql-plperl-debuginfoUpgrade postgresql-contribUpgrade pgaudit-debuginfo | Nov 29, 2023 | Aug 11, 2023 |
| Rocky_linux | — | Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-staticUpgrade postgresql-upgrade-devel-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-docsUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-contribUpgrade postgresql-serverUpgrade postgresql-test-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade pg_repack-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-debuginfoUpgrade pgauditUpgrade pg_repackUpgrade postgresql-plperlUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresqlUpgrade pgaudit-debugsourceUpgrade postgresql-pltclUpgrade postgresql-server-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-testUpgrade postgresql-upgrade | Mar 5, 2024 | Aug 11, 2023 |
| Suse | — | Upgrade postgresql12-contribUpgrade postgresql15-pltclUpgrade libecpg6-32bitUpgrade postgresql12-testUpgrade postgresql14-pltclUpgrade postgresql13-contribUpgrade postgresql15Upgrade postgresql14-docsUpgrade libecpg6Upgrade postgresql15-testUpgrade postgresql15-develUpgrade postgresql13-server-develUpgrade postgresql14-testUpgrade libpq5Upgrade postgresql15-plperlUpgrade postgresql13-plpythonUpgrade postgresql15-plpythonUpgrade postgresql12Upgrade postgresql15-docsUpgrade postgresql12-plpythonUpgrade postgresql15-llvmjit-develUpgrade postgresql12-llvmjitUpgrade postgresql15-contribUpgrade postgresql13-pltclUpgrade postgresql14-llvmjitUpgrade postgresql12-server-develUpgrade postgresql13-develUpgrade postgresql14-serverUpgrade postgresql12-llvmjit-develUpgrade postgresql15-server-develUpgrade postgresql13-llvmjit-develUpgrade postgresql14-develUpgrade postgresql13-testUpgrade postgresql14-contribUpgrade postgresql13-llvmjitUpgrade postgresql15-serverUpgrade postgresql12-serverUpgrade postgresql14Upgrade postgresql12-pltclUpgrade libpq5-32bitUpgrade postgresql13-plperlUpgrade postgresql15-llvmjitUpgrade postgresql14-llvmjit-develUpgrade postgresql13-serverUpgrade postgresql13Upgrade postgresql12-docsUpgrade postgresql12-develUpgrade postgresql14-plperlUpgrade postgresql12-plperlUpgrade postgresql13-docsUpgrade postgresql14-plpythonUpgrade postgresql14-server-devel | Aug 18, 2023 | Aug 11, 2023 |
| Ubuntu | — | Upgrade postgresql-client-12Upgrade postgresql-14Upgrade postgresql-client-15Upgrade postgresql-client-14Upgrade postgresql-client-9.5 (Ubuntu Pro)Upgrade postgresql-12Upgrade postgresql-9.5 (Ubuntu Pro)Upgrade postgresql-15 | Aug 18, 2023 | Aug 11, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub