Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-private-libsUpgrade postgresql-plpython3Upgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-serverUpgrade pg_repackUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufsUpgrade postgresql-private-develUpgrade postgresql-docsUpgrade pgaudit | Jun 27, 2023 | Jun 9, 2023 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresqlUpgrade postgresql12Upgrade postgresql13Upgrade postgresql15 | Mar 26, 2024 | Jun 9, 2023 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-upgradeUpgrade postgresql-private-libsUpgrade postgresql-plpython3Upgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-llvmjitUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-plpython2Upgrade postgresql-test-rpm-macrosUpgrade postgresqlUpgrade postgresql-upgrade-develUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-debuginfoUpgrade postgresql-private-develUpgrade postgresql-devel | Sep 28, 2023 | Jun 9, 2023 |
| Amazon_linux_2023 | — | Upgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-test-debuginfoUpgrade postgresql15-pltclUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-testUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-contribUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-llvmjitUpgrade postgresql15-upgrade-develUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql15-serverUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql15-docsUpgrade postgresql15-private-develUpgrade postgresql15-plperlUpgrade postgresql15-debuginfoUpgrade postgresql15Upgrade postgresql15-plpython3Upgrade postgresql15-plperl-debuginfoUpgrade postgresql15-debugsourceUpgrade postgresql15-staticUpgrade postgresql15-private-libsUpgrade postgresql15-server-devel | Feb 17, 2025 | May 11, 2023 |
| Centos_linux | — | Upgrade postgresql-serverUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-testUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-pltclUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-server-debuginfoUpgrade pg_repackUpgrade pg_repack-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-docsUpgrade postgresql-debugsourceUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-private-develUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufsUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgauditUpgrade pg_repack-debugsourceUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debuginfo | Jun 22, 2023 | Jun 9, 2023 |
| Debian | — | Upgrade postgresql-15Upgrade postgresql-13 | May 15, 2023 | May 15, 2023 |
| Dell Powerstore Dsa2023366 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 5, 2023 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | May 11, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-plpythonUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-contrib | Jan 10, 2024 | Jun 9, 2023 |
| Oracle_linux | — | Upgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade pgauditUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-private-develUpgrade pg_repackUpgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgresql-private-libsUpgrade postgresql-server-develUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql | Jun 22, 2023 | May 11, 2023 |
| Postgres | — | Upgrade to PostgreSQL version 15.3Upgrade to PostgreSQL version 14.8 | Jun 9, 2023 | Jun 9, 2023 |
| Redhat_linux | — | Upgrade postgresql-contrib-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-develUpgrade postgresql-staticUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-docsUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-testUpgrade postgresql-private-libsUpgrade pgaudit-debugsourceUpgrade postgresql-docs-debuginfoUpgrade pgauditUpgrade postgresql-private-develNo solution existsUpgrade pg_repackUpgrade postgresql-pltcl-debuginfoUpgrade postgres-decoderbufsUpgrade pgaudit-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade pg_repack-debugsourceUpgrade pg_repack-debuginfoUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresqlUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade | Jun 22, 2023 | Jun 9, 2023 |
| Rocky_linux | — | Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgres-decoderbufsUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-contribUpgrade pg_repack-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgradeUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-server-develUpgrade pg_repack-debugsourceUpgrade pgauditUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-private-develUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-plperlUpgrade pgaudit-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade postgresqlUpgrade pgaudit-debugsourceUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-debugsourceUpgrade pg_repackUpgrade postgresql-pltclUpgrade postgresql-docs-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-server | Mar 5, 2024 | Jun 9, 2023 |
| Suse | — | Upgrade postgresql13-server-develUpgrade postgresql13Upgrade postgresql15Upgrade postgresql15-plperlUpgrade postgresql15-develUpgrade postgresql12-plperlUpgrade postgresql15-testUpgrade postgresql13-plperlUpgrade postgresql13-llvmjit-develUpgrade postgresql13-develUpgrade libpq5Upgrade postgresql12-testUpgrade postgresql12-contribUpgrade postgresql13-contribUpgrade postgresql12Upgrade postgresql13-serverUpgrade postgresql12-develUpgrade postgresql14-server-develUpgrade libecpg6-32bitUpgrade postgresql13-pltclUpgrade postgresql15-plpythonUpgrade postgresql14-serverUpgrade postgresql12-plpythonUpgrade postgresql12-llvmjitUpgrade postgresql15-pltclUpgrade postgresql12-llvmjit-develUpgrade postgresql14-docsUpgrade postgresql14-pltclUpgrade postgresql14-testUpgrade postgresql14-llvmjit-develUpgrade postgresql15-llvmjit-develUpgrade postgresql12-server-develUpgrade postgresql15-contribUpgrade postgresql13-llvmjitUpgrade postgresql14Upgrade postgresql14-develUpgrade postgresql14-llvmjitUpgrade postgresql12-serverUpgrade libpq5-32bitUpgrade postgresql13-testUpgrade postgresql14-plpythonUpgrade postgresql15-serverUpgrade postgresql13-docsUpgrade libecpg6Upgrade postgresql13-plpythonUpgrade postgresql12-pltclUpgrade postgresql12-docsUpgrade postgresql14-contribUpgrade postgresql15-llvmjitUpgrade postgresql15-server-develUpgrade postgresql14-plperlUpgrade postgresql15-docs | May 16, 2023 | May 15, 2023 |
| Ubuntu | — | Upgrade postgresql-client-10Upgrade postgresql-14Upgrade postgresql-12Upgrade postgresql-10Upgrade postgresql-client-14Upgrade postgresql-client-12Upgrade postgresql-15Upgrade postgresql-client-15 | May 25, 2023 | May 24, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub