Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade pg_repackUpgrade postgresql-staticUpgrade postgresql-private-develUpgrade postgresql-docsUpgrade pgauditUpgrade postgresql-serverUpgrade postgres-decoderbufsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-private-libsUpgrade postgresql-plpython3Upgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-test | Jun 27, 2023 | Jun 9, 2023 |
| Alpine Linux | — | Upgrade postgresql13Upgrade postgresql15Upgrade postgresqlUpgrade postgresql12Upgrade postgresql14 | Mar 26, 2024 | Jun 9, 2023 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-debuginfoUpgrade postgresql-docsUpgrade postgresql-upgrade-develUpgrade postgresql-develUpgrade postgresqlUpgrade postgresql-private-develUpgrade postgresql-staticUpgrade postgresql-plpythonUpgrade postgresql-server-develUpgrade postgresql-private-libsUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresql-plpython2Upgrade postgresql-llvmjitUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-plpython3Upgrade postgresql-libs | Sep 28, 2023 | Jun 9, 2023 |
| Amazon_linux_2023 | — | Upgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-test-debuginfoUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-contribUpgrade postgresql15-testUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-pltclUpgrade postgresql15-llvmjitUpgrade postgresql15-serverUpgrade postgresql15-private-libsUpgrade postgresql15-staticUpgrade postgresql15-server-develUpgrade postgresql15-upgrade-develUpgrade postgresql15Upgrade postgresql15-plperlUpgrade postgresql15-docsUpgrade postgresql15-upgradeUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-debuginfoUpgrade postgresql15-debugsourceUpgrade postgresql15-private-develUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql15-plpython3 | Feb 17, 2025 | May 11, 2023 |
| Centos_linux | — | Upgrade postgresql-plperl-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-pltcl-debuginfoUpgrade pgauditUpgrade postgresql-contribUpgrade pgaudit-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plpython3Upgrade postgres-decoderbufs-debuginfoUpgrade postgresql-private-develUpgrade postgres-decoderbufsUpgrade postgresql-staticUpgrade postgresql-private-libsUpgrade pg_repack-debuginfoUpgrade pg_repackUpgrade postgresql-testUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-server-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresqlUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-plperlUpgrade postgresql-docsUpgrade postgresql-server-devel | Jun 22, 2023 | Jun 9, 2023 |
| Debian | — | Upgrade postgresql-13Upgrade postgresql-15 | May 15, 2023 | May 15, 2023 |
| Dell Powerstore Dsa2023366 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 5, 2023 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | May 11, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-develUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-plpythonUpgrade postgresql-test | Jan 10, 2024 | Jun 9, 2023 |
| Oracle_linux | — | Upgrade postgresql-testUpgrade postgresql-plpython3Upgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-upgrade-develUpgrade postgresql-private-libsUpgrade postgres-decoderbufsUpgrade pg_repackUpgrade postgresql-docsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-private-develUpgrade postgresql-plperlUpgrade postgresql-staticUpgrade pgaudit | Jun 22, 2023 | May 11, 2023 |
| Postgres | — | Upgrade to PostgreSQL version 15.3Upgrade to PostgreSQL version 14.8 | Jun 9, 2023 | Jun 9, 2023 |
| Redhat_linux | — | Upgrade postgres-decoderbufs-debuginfoUpgrade postgresql-private-develUpgrade postgresqlUpgrade postgresql-private-libsUpgrade postgresql-plperlUpgrade postgresql-server-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-upgrade-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-serverUpgrade postgresql-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-debugsourceUpgrade pg_repack-debuginfoUpgrade postgresql-upgradeUpgrade pg_repack-debugsourceUpgrade pgauditUpgrade pgaudit-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade pg_repackUpgrade postgres-decoderbufsNo solution existsUpgrade postgresql-test-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-upgrade-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-static | Jun 22, 2023 | Jun 9, 2023 |
| Rocky_linux | — | Upgrade postgresql-debugsourceUpgrade postgresql-serverUpgrade pg_repackUpgrade postgresql-private-libsUpgrade postgresql-plperlUpgrade pgaudit-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-server-debuginfoUpgrade postgresql-docs-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-testUpgrade postgresqlUpgrade postgres-decoderbufsUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-upgradeUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plpython3Upgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade pg_repack-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-pltcl-debuginfoUpgrade pgauditUpgrade pg_repack-debugsourceUpgrade postgresql-server-develUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-private-devel | Mar 5, 2024 | Jun 9, 2023 |
| Suse | — | Upgrade postgresql14-plperlUpgrade postgresql14-llvmjitUpgrade postgresql14-develUpgrade postgresql15-docsUpgrade postgresql12-serverUpgrade postgresql15-llvmjitUpgrade postgresql15-serverUpgrade postgresql13-plpythonUpgrade postgresql14-plpythonUpgrade postgresql13-testUpgrade postgresql14Upgrade postgresql15-server-develUpgrade libpq5-32bitUpgrade libecpg6Upgrade postgresql14-contribUpgrade postgresql13-docsUpgrade postgresql12-docsUpgrade postgresql12-pltclUpgrade postgresql13-pltclUpgrade postgresql13-serverUpgrade libecpg6-32bitUpgrade postgresql12-llvmjit-develUpgrade postgresql14-server-develUpgrade postgresql15-testUpgrade postgresql15Upgrade postgresql12-plperlUpgrade postgresql15-contribUpgrade postgresql14-pltclUpgrade postgresql12-testUpgrade postgresql12-llvmjitUpgrade postgresql12-plpythonUpgrade postgresql15-plperlUpgrade postgresql12-server-develUpgrade postgresql14-llvmjit-develUpgrade postgresql13-contribUpgrade postgresql14-docsUpgrade postgresql12-contribUpgrade postgresql15-llvmjit-develUpgrade postgresql13-develUpgrade libpq5Upgrade postgresql15-develUpgrade postgresql13-server-develUpgrade postgresql13-plperlUpgrade postgresql13-llvmjit-develUpgrade postgresql12-develUpgrade postgresql13Upgrade postgresql15-plpythonUpgrade postgresql12Upgrade postgresql14-testUpgrade postgresql15-pltclUpgrade postgresql14-serverUpgrade postgresql13-llvmjit | May 16, 2023 | May 15, 2023 |
| Ubuntu | — | Upgrade postgresql-client-14Upgrade postgresql-client-10Upgrade postgresql-10Upgrade postgresql-client-12Upgrade postgresql-14Upgrade postgresql-12Upgrade postgresql-15Upgrade postgresql-client-15 | May 25, 2023 | May 24, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub