IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-upgradeUpgrade postgres-decoderbufsUpgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgresqlUpgrade pgauditUpgrade postgresql-testUpgrade postgresql-private-libsUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-private-develUpgrade postgresql-staticUpgrade pg_repackUpgrade postgresql-upgrade-develUpgrade postgresql-docs | Dec 5, 2023 | Aug 11, 2023 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresqlUpgrade postgresql12Upgrade postgresql15Upgrade postgresql13 | Aug 22, 2024 | Aug 11, 2023 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-server-develUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-private-libsUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-private-develUpgrade postgresql-upgradeUpgrade postgresql-llvmjitUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-plpython2Upgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-develUpgrade postgresql-debuginfo | Sep 28, 2023 | Aug 11, 2023 |
| Amazon_linux_2023 | — | Upgrade postgresql15-upgrade-develUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-plpython3Upgrade postgresql15-upgradeUpgrade postgresql15-serverUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-docsUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-server-develUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-testUpgrade postgresql15-private-libsUpgrade postgresql15-plperlUpgrade postgresql15-test-debuginfoUpgrade postgresql15-debugsourceUpgrade postgresql15-private-develUpgrade postgresql15Upgrade postgresql15-plperl-debuginfoUpgrade postgresql15-pltclUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-debuginfoUpgrade postgresql15-llvmjitUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-staticUpgrade postgresql15-server-debuginfoUpgrade postgresql15-contrib | Feb 17, 2025 | Aug 10, 2023 |
| Centos_linux | — | Upgrade pg_repack-debugsourceUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-test-debuginfoUpgrade pgauditUpgrade postgresql-staticUpgrade postgresql-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-serverUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-server-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade pg_repackUpgrade pg_repack-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plperlUpgrade postgresql-plpython3Upgrade pgaudit-debugsourceUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-upgrade-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-private-develUpgrade postgresql-private-libsUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-upgrade | Nov 30, 2023 | Aug 11, 2023 |
| Debian | — | Upgrade postgresql-15Upgrade pgextwlistUpgrade postgresql-13 | Oct 5, 2023 | Aug 11, 2023 |
| Freebsd | — | Upgrade postgresql-server | Aug 11, 2023 | Aug 10, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-test | Jan 10, 2024 | Aug 11, 2023 |
| Oracle_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgresql-private-develUpgrade pg_repackUpgrade postgresql-staticUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade pgauditUpgrade postgresql-testUpgrade postgresql-server-develUpgrade postgresql-private-libsUpgrade postgres-decoderbufsUpgrade postgresql-plpython3Upgrade postgresql-upgrade-develUpgrade postgresqlUpgrade postgresql-upgrade | Dec 1, 2023 | Aug 10, 2023 |
| Postgres | — | Upgrade to PostgreSQL version 14.9Upgrade to PostgreSQL version 15.4 | Aug 11, 2023 | Aug 11, 2023 |
| Redhat_linux | — | Upgrade pgaudit-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade pgaudit-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltclUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plpython3Upgrade pg_repackUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-debugsourceUpgrade postgresql-server-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-staticNo solution existsUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgresql-private-develUpgrade postgresql-docsUpgrade postgresql-private-libsUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-pltcl-debuginfo | Nov 29, 2023 | Aug 11, 2023 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-contribUpgrade postgresql-serverUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-staticUpgrade postgresql-contrib-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-docsUpgrade postgresql-docs-debuginfoUpgrade postgresql-plperlUpgrade postgresqlUpgrade pgauditUpgrade pgaudit-debuginfoUpgrade postgresql-testUpgrade postgresql-server-debuginfoUpgrade pgaudit-debugsourceUpgrade pg_repackUpgrade postgresql-upgradeUpgrade pg_repack-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plpython3Upgrade postgresql-debugsourceUpgrade postgresql-server-develUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufs | Mar 5, 2024 | Aug 11, 2023 |
| Suse | — | Upgrade postgresql14-llvmjitUpgrade postgresql12-llvmjitUpgrade postgresql15-llvmjit-develUpgrade postgresql12-llvmjit-develUpgrade postgresql13-pltclUpgrade postgresql12-plpythonUpgrade postgresql15-server-develUpgrade postgresql12-contribUpgrade libecpg6-32bitUpgrade postgresql13-server-develUpgrade postgresql15-testUpgrade postgresql15-plperlUpgrade postgresql14-pltclUpgrade postgresql15Upgrade postgresql13-contribUpgrade postgresql15-pltclUpgrade postgresql15-plpythonUpgrade postgresql15-docsUpgrade postgresql15-develUpgrade postgresql12-develUpgrade postgresql12-plperlUpgrade postgresql13-docsUpgrade postgresql12-testUpgrade postgresql13-plpythonUpgrade postgresql14-testUpgrade libecpg6Upgrade postgresql14-docsUpgrade libpq5Upgrade postgresql13-develUpgrade postgresql15-contribUpgrade postgresql12-server-develUpgrade postgresql14-serverUpgrade postgresql12 | Aug 18, 2023 | Aug 11, 2023 |
| Ubuntu | — | Upgrade postgresql-client-12Upgrade postgresql-14Upgrade postgresql-client-15Upgrade postgresql-9.5 (Ubuntu Pro)Upgrade postgresql-15Upgrade postgresql-12Upgrade postgresql-client-9.5 (Ubuntu Pro)Upgrade postgresql-client-14 | Aug 18, 2023 | Aug 11, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub