A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-plpython3Upgrade postgresql-pltclUpgrade postgresql-server-develUpgrade postgresql-private-libsUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade postgresql-upgrade-develUpgrade pgauditUpgrade postgresql-testUpgrade postgresqlUpgrade postgres-decoderbufsUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-docsUpgrade pg_repackUpgrade postgresql-private-devel | Dec 27, 2023 | Aug 11, 2023 |
| Alpine Linux | — | Upgrade postgresql13Upgrade postgresql12Upgrade postgresqlUpgrade postgresql15Upgrade postgresql14 | Aug 22, 2024 | Aug 11, 2023 |
| Amazon_linux_2023 | — | Upgrade postgresql15-upgradeUpgrade postgresql15-test-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-staticUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-serverUpgrade postgresql15-llvmjitUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15Upgrade postgresql15-docsUpgrade postgresql15-server-develUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-contribUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-private-develUpgrade postgresql15-upgrade-develUpgrade postgresql15-testUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-plperlUpgrade postgresql15-pltclUpgrade postgresql15-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql15-private-libsUpgrade postgresql15-debugsourceUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-plpython3 | Feb 17, 2025 | Aug 10, 2023 |
| Centos_linux | — | Upgrade postgresql-upgradeUpgrade postgresql-upgrade-develUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-staticUpgrade postgresql-plpython3Upgrade postgresql-plperl-debuginfoUpgrade postgresql-contribUpgrade pg_repack-debugsourceUpgrade pg_repack-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade pgauditUpgrade postgresql-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-private-develUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade pg_repackUpgrade postgresql-server-develUpgrade postgresqlUpgrade pgaudit-debuginfoUpgrade postgresql-testUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-serverUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-pltclUpgrade postgresql-debugsourceUpgrade pgaudit-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-docsUpgrade postgresql-server-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-plperl | Dec 14, 2023 | Aug 11, 2023 |
| Debian | — | Upgrade postgresql-15 | Nov 20, 2023 | Aug 11, 2023 |
| Freebsd | — | Upgrade postgresql-server | Aug 11, 2023 | Aug 10, 2023 |
| Oracle_linux | — | Upgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-pltclUpgrade pg_repackUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plpython3Upgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufsUpgrade postgresql-upgradeUpgrade pgauditUpgrade postgresql-private-libsUpgrade postgresql-docsUpgrade postgresql-private-devel | Dec 14, 2023 | Aug 10, 2023 |
| Postgres | — | Upgrade to PostgreSQL version 15.4 | Aug 11, 2023 | Aug 11, 2023 |
| Redhat_linux | — | Upgrade postgresql-docs-debuginfoUpgrade postgresql-server-develUpgrade postgresql-server-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-plpython3Upgrade pgaudit-debuginfoUpgrade postgresql-upgrade-develUpgrade pg_repack-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgauditUpgrade postgresql-staticUpgrade postgresql-serverUpgrade postgresql-test-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plperl-debuginfoUpgrade postgresql-docsUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-private-develUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade pg_repackUpgrade postgres-decoderbufs | Dec 14, 2023 | Aug 11, 2023 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade pg_repack-debugsourceUpgrade pg_repack-debuginfoUpgrade postgres-decoderbufsUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debugsourceUpgrade pg_repack | Mar 5, 2024 | Aug 11, 2023 |
| Suse | — | Upgrade postgresql15-pltclUpgrade libpq5-32bitUpgrade postgresql15-plpythonUpgrade postgresql15Upgrade libecpg6-32bitUpgrade postgresql15-contribUpgrade libpq5Upgrade postgresql15-llvmjitUpgrade postgresql15-llvmjit-develUpgrade postgresql15-server-develUpgrade postgresql15-serverUpgrade postgresql15-docsUpgrade libecpg6Upgrade postgresql15-testUpgrade postgresql15-plperlUpgrade postgresql15-devel | Aug 18, 2023 | Aug 11, 2023 |
| Ubuntu | — | Upgrade postgresql-client-15Upgrade postgresql-15 | Aug 18, 2023 | Aug 11, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 20, 2026 | Aug 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub