Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-private-libsUpgrade postgresql-testUpgrade postgresql-plpython3Upgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-server-develUpgrade postgresql-private-develUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-upgrade-develUpgrade pg_repackUpgrade pgauditUpgrade postgresql-staticUpgrade postgres-decoderbufs | Jun 27, 2023 | Jun 9, 2023 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresqlUpgrade postgresql12Upgrade postgresql13Upgrade postgresql15 | Mar 26, 2024 | Jun 9, 2023 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-upgrade-develUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-private-develUpgrade postgresql-develUpgrade postgresql-debuginfoUpgrade postgresql-staticUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-contribUpgrade postgresql-libsUpgrade postgresql-plpython2Upgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-plpythonUpgrade postgresql-private-libsUpgrade postgresql-llvmjitUpgrade postgresql-upgrade | Sep 28, 2023 | Jun 9, 2023 |
| Amazon_linux_2023 | — | Upgrade postgresql15-testUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-contribUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-test-debuginfoUpgrade postgresql15-pltclUpgrade postgresql15-docsUpgrade postgresql15-staticUpgrade postgresql15-plperlUpgrade postgresql15-debuginfoUpgrade postgresql15Upgrade postgresql15-upgradeUpgrade postgresql15-private-libsUpgrade postgresql15-debugsourceUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-plpython3Upgrade postgresql15-private-develUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-llvmjitUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-serverUpgrade postgresql15-server-debuginfoUpgrade postgresql15-server-develUpgrade postgresql15-upgrade-devel | Feb 17, 2025 | May 11, 2023 |
| Centos_linux | — | Upgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgresql-staticUpgrade postgresql-plpython3Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-contrib-debuginfoUpgrade postgresql-debuginfoUpgrade pgauditUpgrade pg_repack-debugsourceUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-private-develUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-develUpgrade pgaudit-debugsourceUpgrade postgresql-contribUpgrade postgresqlUpgrade pg_repackUpgrade postgresql-serverUpgrade postgresql-testUpgrade pg_repack-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-pltclUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-docsUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresql-server-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-docs-debuginfo | Jun 22, 2023 | Jun 9, 2023 |
| Debian | — | Upgrade postgresql-15Upgrade postgresql-13 | May 15, 2023 | May 15, 2023 |
| Dell Powerstore Dsa2023366 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 5, 2023 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | May 11, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-plpythonUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-devel | Jan 10, 2024 | Jun 9, 2023 |
| Oracle_linux | — | Upgrade postgresql-serverUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-private-libsUpgrade postgresql-testUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-plpython3Upgrade postgresql-private-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-staticUpgrade pgauditUpgrade postgresql-plperlUpgrade pg_repackUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgres-decoderbufs | Jun 22, 2023 | May 11, 2023 |
| Postgres | — | Upgrade to PostgreSQL version 15.3Upgrade to PostgreSQL version 14.8 | Jun 9, 2023 | Jun 9, 2023 |
| Redhat_linux | — | Upgrade postgresql-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade pgauditUpgrade pg_repack-debuginfoUpgrade postgresql-server-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-plperlUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-serverUpgrade pgaudit-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-plpython3Upgrade postgres-decoderbufsUpgrade postgresql-private-develUpgrade postgresql-testUpgrade postgresql-private-libsUpgrade postgresql-upgradeUpgrade postgresql-pltcl-debuginfoNo solution existsUpgrade postgresql-server-develUpgrade postgresql-debugsourceUpgrade pg_repackUpgrade postgresqlUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-staticUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperl-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgres-decoderbufs-debugsource | Jun 22, 2023 | Jun 9, 2023 |
| Rocky_linux | — | Upgrade postgresql-debugsourceUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-server-debuginfoUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade pg_repackUpgrade pgaudit-debuginfoUpgrade postgresql-pltclUpgrade postgresqlUpgrade pgaudit-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperlUpgrade postgresql-private-libsUpgrade postgresql-serverUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pg_repack-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade postgresql-contribUpgrade postgresql-server-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade pgauditUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-private-develUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgres-decoderbufs-debuginfo | Mar 5, 2024 | Jun 9, 2023 |
| Suse | — | Upgrade postgresql15-docsUpgrade postgresql14-llvmjitUpgrade postgresql15-server-develUpgrade postgresql14-contribUpgrade postgresql15-serverUpgrade postgresql12-pltclUpgrade postgresql14-plperlUpgrade postgresql14-develUpgrade postgresql12-docsUpgrade postgresql13-plpythonUpgrade postgresql14-plpythonUpgrade postgresql12-serverUpgrade postgresql14Upgrade libpq5-32bitUpgrade postgresql15-llvmjitUpgrade postgresql13-docsUpgrade libecpg6Upgrade postgresql13-testUpgrade postgresql12-llvmjit-develUpgrade postgresql15-pltclUpgrade postgresql13-llvmjitUpgrade postgresql14-testUpgrade postgresql13-server-develUpgrade libpq5Upgrade postgresql13-plperlUpgrade postgresql13-llvmjit-develUpgrade postgresql13Upgrade postgresql12-testUpgrade postgresql12-plperlUpgrade postgresql15-testUpgrade postgresql15Upgrade postgresql14-server-develUpgrade postgresql14-serverUpgrade postgresql13-serverUpgrade postgresql13-contribUpgrade postgresql15-plperlUpgrade postgresql12-contribUpgrade postgresql12-server-develUpgrade postgresql15-develUpgrade postgresql12-llvmjitUpgrade postgresql15-contribUpgrade postgresql14-pltclUpgrade postgresql12-plpythonUpgrade postgresql14-llvmjit-develUpgrade postgresql14-docsUpgrade postgresql13-pltclUpgrade postgresql13-develUpgrade postgresql15-llvmjit-develUpgrade postgresql15-plpythonUpgrade postgresql12-develUpgrade postgresql12Upgrade libecpg6-32bit | May 16, 2023 | May 15, 2023 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-12Upgrade postgresql-client-14Upgrade postgresql-14Upgrade postgresql-client-10Upgrade postgresql-client-12Upgrade postgresql-client-15Upgrade postgresql-15 | May 25, 2023 | May 24, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub