IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pgauditUpgrade postgresql-serverUpgrade postgresql-private-libsUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresqlUpgrade postgres-decoderbufsUpgrade postgresql-testUpgrade postgresql-private-develUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade pg_repackUpgrade postgresql-upgrade-devel | Dec 5, 2023 | Aug 11, 2023 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql13Upgrade postgresql12Upgrade postgresql14Upgrade postgresql | Aug 22, 2024 | Aug 11, 2023 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-plpython2Upgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-private-develUpgrade postgresql-docsUpgrade postgresql-debuginfoUpgrade postgresql-llvmjitUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-private-libsUpgrade postgresql-static | Sep 28, 2023 | Aug 11, 2023 |
| Amazon_linux_2023 | — | Upgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-testUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-llvmjitUpgrade postgresql15-test-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-plperlUpgrade postgresql15-staticUpgrade postgresql15-debuginfoUpgrade postgresql15-private-develUpgrade postgresql15-pltclUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-private-libsUpgrade postgresql15Upgrade postgresql15-contribUpgrade postgresql15-debugsourceUpgrade postgresql15-upgrade-develUpgrade postgresql15-server-develUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql15-plpython3Upgrade postgresql15-docsUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-serverUpgrade postgresql15-upgrade-devel-debuginfo | Feb 17, 2025 | Aug 10, 2023 |
| Centos_linux | — | Upgrade postgresql-server-devel-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-plpython3Upgrade postgresql-docs-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade pgaudit-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-pltclUpgrade postgresql-private-develUpgrade postgresql-plperlUpgrade pg_repack-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade pg_repackUpgrade postgresql-server-debuginfoUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-upgrade-develUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade pgauditUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgres-decoderbufsUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-serverUpgrade pg_repack-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade postgresql-pltcl-debuginfo | Nov 30, 2023 | Aug 11, 2023 |
| Debian | — | Upgrade postgresql-15Upgrade pgextwlistUpgrade postgresql-13 | Oct 5, 2023 | Aug 11, 2023 |
| Freebsd | — | Upgrade postgresql-server | Aug 11, 2023 | Aug 10, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-develUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-libsUpgrade postgresql-test | Jan 10, 2024 | Aug 11, 2023 |
| Oracle_linux | — | Upgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade pg_repackUpgrade postgresql-docsUpgrade postgresql-private-develUpgrade pgauditUpgrade postgresql-pltclUpgrade postgresql-private-libsUpgrade postgresql-upgradeUpgrade postgres-decoderbufsUpgrade postgresqlUpgrade postgresql-upgrade-develUpgrade postgresql-testUpgrade postgresql-plpython3Upgrade postgresql-server-devel | Dec 1, 2023 | Aug 10, 2023 |
| Postgres | — | Upgrade to PostgreSQL version 15.4Upgrade to PostgreSQL version 14.9 | Aug 11, 2023 | Aug 11, 2023 |
| Redhat_linux | — | Upgrade postgres-decoderbufsUpgrade postgresql-private-libsUpgrade postgresql-staticUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-docsUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-private-develUpgrade postgresql-upgrade-develUpgrade pgauditUpgrade pg_repack-debugsourceUpgrade postgresql-server-debuginfoNo solution existsUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade pg_repackUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-serverUpgrade pg_repack-debuginfoUpgrade postgresql-test-rpm-macros | Nov 29, 2023 | Aug 11, 2023 |
| Rocky_linux | — | Upgrade postgresql-testUpgrade postgresql-pltclUpgrade pgaudit-debugsourceUpgrade postgresql-server-debuginfoUpgrade postgresqlUpgrade postgresql-plperlUpgrade pg_repackUpgrade pgauditUpgrade postgres-decoderbufsUpgrade pgaudit-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-debuginfoUpgrade postgresql-upgradeUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-serverUpgrade postgresql-staticUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-contribUpgrade postgresql-test-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-docsUpgrade pg_repack-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plpython3-debuginfo | Mar 5, 2024 | Aug 11, 2023 |
| Suse | — | Upgrade postgresql14-plperlUpgrade postgresql14Upgrade postgresql12-develUpgrade postgresql12-plperlUpgrade postgresql13-serverUpgrade postgresql13-testUpgrade postgresql14-develUpgrade postgresql12-docsUpgrade postgresql13-docsUpgrade postgresql13-llvmjitUpgrade postgresql12-serverUpgrade postgresql15-llvmjitUpgrade postgresql13-llvmjit-develUpgrade postgresql13Upgrade postgresql14-server-develUpgrade postgresql15-serverUpgrade postgresql13-plperlUpgrade postgresql12-pltclUpgrade libpq5-32bitUpgrade postgresql15Upgrade postgresql14-pltclUpgrade postgresql13-server-develUpgrade postgresql15-plperlUpgrade postgresql12-server-develUpgrade postgresql15-plpythonUpgrade postgresql13-develUpgrade postgresql13-plpythonUpgrade postgresql14-docsUpgrade postgresql15-contribUpgrade postgresql15-testUpgrade postgresql14-contribUpgrade postgresql14-plpythonUpgrade postgresql14-llvmjit-devel | Aug 18, 2023 | Aug 11, 2023 |
| Ubuntu | — | Upgrade postgresql-client-15Upgrade postgresql-14Upgrade postgresql-client-12Upgrade postgresql-9.5 (Ubuntu Pro)Upgrade postgresql-15Upgrade postgresql-client-14Upgrade postgresql-client-9.5 (Ubuntu Pro)Upgrade postgresql-12 | Aug 18, 2023 | Aug 11, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub