Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pg_repackUpgrade postgresql-docsUpgrade postgresql-private-develUpgrade pgauditUpgrade postgresql-staticUpgrade postgres-decoderbufsUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade postgresql-private-libsUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgradeUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-test | Jun 27, 2023 | Jun 9, 2023 |
| Alpine Linux | — | Upgrade postgresql12Upgrade postgresql14Upgrade postgresqlUpgrade postgresql15Upgrade postgresql13 | Mar 26, 2024 | Jun 9, 2023 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-testUpgrade postgresql-llvmjitUpgrade postgresql-serverUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgradeUpgrade postgresql-plperlUpgrade postgresql-plpython2Upgrade postgresql-server-develUpgrade postgresql-private-libsUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-libsUpgrade postgresql-contribUpgrade postgresql-plpython3Upgrade postgresql-debuginfoUpgrade postgresql-private-develUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-develUpgrade postgresql-staticUpgrade postgresql-upgrade-devel | Sep 28, 2023 | Jun 9, 2023 |
| Amazon_linux_2023 | — | Upgrade postgresql15-upgradeUpgrade postgresql15-docsUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-plperlUpgrade postgresql15Upgrade postgresql15-debuginfoUpgrade postgresql15-llvmjitUpgrade postgresql15-serverUpgrade postgresql15-server-develUpgrade postgresql15-upgrade-develUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-plpython3Upgrade postgresql15-staticUpgrade postgresql15-debugsourceUpgrade postgresql15-private-libsUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-private-develUpgrade postgresql15-server-debuginfoUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-test-debuginfoUpgrade postgresql15-testUpgrade postgresql15-contribUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-pltcl | Feb 17, 2025 | May 11, 2023 |
| Centos_linux | — | Upgrade pg_repack-debugsourceUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-private-develUpgrade postgres-decoderbufsUpgrade postgresql-plpython3Upgrade pgaudit-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-contribUpgrade pgauditUpgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-server-develUpgrade pg_repackUpgrade postgresql-server-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-testUpgrade pgaudit-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresqlUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-debugsourceUpgrade postgresql-private-libsUpgrade postgresql-plperl | Jun 22, 2023 | Jun 9, 2023 |
| Debian | — | Upgrade postgresql-15Upgrade postgresql-13 | May 15, 2023 | May 15, 2023 |
| Dell Powerstore Dsa2023366 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 5, 2023 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | May 11, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-plpythonUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-plperl | Jan 10, 2024 | Jun 9, 2023 |
| Oracle_linux | — | Upgrade postgresql-private-libsUpgrade postgresql-plpython3Upgrade postgresql-serverUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-private-develUpgrade postgresql-plperlUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade pg_repackUpgrade pgauditUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade postgresql-static | Jun 22, 2023 | May 11, 2023 |
| Postgres | — | Upgrade to PostgreSQL version 15.3Upgrade to PostgreSQL version 14.8 | Jun 9, 2023 | Jun 9, 2023 |
| Redhat_linux | — | Upgrade pg_repack-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-serverUpgrade pgaudit-debuginfoUpgrade pg_repackUpgrade postgres-decoderbufsUpgrade postgresql-debuginfoUpgrade postgresql-private-libsNo solution existsUpgrade postgresql-testUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-server-develUpgrade postgresqlUpgrade pgauditUpgrade pg_repack-debugsourceUpgrade postgresql-plperlUpgrade postgresql-docs-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-private-develUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plperl-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-contribUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-docsUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-staticUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-test-rpm-macros | Jun 22, 2023 | Jun 9, 2023 |
| Rocky_linux | — | Upgrade pgaudit-debugsourceUpgrade postgresql-server-debuginfoUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade postgresqlUpgrade postgresql-serverUpgrade pgaudit-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-staticUpgrade pg_repackUpgrade postgresql-private-libsUpgrade postgresql-test-debuginfoUpgrade postgresql-pltclUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgres-decoderbufsUpgrade pg_repack-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-contribUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-server-develUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade pg_repack-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade postgresql-private-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-plpython3 | Mar 5, 2024 | Jun 9, 2023 |
| Suse | — | Upgrade postgresql13-plpythonUpgrade postgresql14-plperlUpgrade postgresql12-serverUpgrade postgresql14-develUpgrade postgresql12-docsUpgrade postgresql14-llvmjitUpgrade postgresql15-serverUpgrade postgresql13-docsUpgrade postgresql12-pltclUpgrade postgresql14-contribUpgrade postgresql15-docsUpgrade libecpg6Upgrade postgresql14Upgrade libpq5-32bitUpgrade postgresql15-server-develUpgrade postgresql14-plpythonUpgrade postgresql15-llvmjitUpgrade postgresql13-testUpgrade postgresql14-pltclUpgrade postgresql15-contribUpgrade postgresql15-plperlUpgrade postgresql15-develUpgrade postgresql14-docsUpgrade postgresql13-develUpgrade postgresql13-plperlUpgrade postgresql13Upgrade postgresql13-pltclUpgrade postgresql13-llvmjit-develUpgrade postgresql14-llvmjit-develUpgrade postgresql12-server-develUpgrade postgresql12-develUpgrade postgresql12-plpythonUpgrade postgresql12-llvmjitUpgrade postgresql13-contribUpgrade postgresql12-contribUpgrade libecpg6-32bitUpgrade postgresql12Upgrade postgresql14-server-develUpgrade postgresql15-testUpgrade postgresql15Upgrade postgresql12-plperlUpgrade postgresql12-testUpgrade postgresql15-plpythonUpgrade postgresql14-serverUpgrade postgresql13-llvmjitUpgrade postgresql12-llvmjit-develUpgrade libpq5Upgrade postgresql13-server-develUpgrade postgresql15-pltclUpgrade postgresql14-testUpgrade postgresql13-serverUpgrade postgresql15-llvmjit-devel | May 16, 2023 | May 15, 2023 |
| Ubuntu | — | Upgrade postgresql-client-15Upgrade postgresql-15Upgrade postgresql-10Upgrade postgresql-client-14Upgrade postgresql-12Upgrade postgresql-14Upgrade postgresql-client-12Upgrade postgresql-client-10 | May 25, 2023 | May 24, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub