IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pgauditUpgrade postgresql-testUpgrade postgres-decoderbufsUpgrade postgresql-plpython3Upgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-private-libsUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresql-upgrade-develUpgrade postgresql-staticUpgrade postgresql-docsUpgrade pg_repackUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-private-develUpgrade postgresql-contrib | Dec 5, 2023 | Aug 11, 2023 |
| Alpine Linux | — | Upgrade postgresql13Upgrade postgresql15Upgrade postgresql14Upgrade postgresqlUpgrade postgresql12 | Aug 22, 2024 | Aug 11, 2023 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-private-develUpgrade postgresql-plpython2Upgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-develUpgrade postgresql-debuginfoUpgrade postgresql-llvmjitUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-testUpgrade postgresql-server-develUpgrade postgresql-staticUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-private-libsUpgrade postgresql | Sep 28, 2023 | Aug 11, 2023 |
| Amazon_linux_2023 | — | Upgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-test-debuginfoUpgrade postgresql15-llvmjitUpgrade postgresql15-plperlUpgrade postgresql15-private-libsUpgrade postgresql15-staticUpgrade postgresql15Upgrade postgresql15-testUpgrade postgresql15-server-debuginfoUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-debuginfoUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-contribUpgrade postgresql15-pltclUpgrade postgresql15-debugsourceUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-private-develUpgrade postgresql15-docsUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-server-develUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-plpython3Upgrade postgresql15-serverUpgrade postgresql15-upgrade-develUpgrade postgresql15-upgrade | Feb 17, 2025 | Aug 10, 2023 |
| Centos_linux | — | Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-private-develUpgrade pgaudit-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-plpython3Upgrade pg_repack-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresqlUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-develUpgrade pg_repackUpgrade postgresql-server-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-staticUpgrade postgresql-serverUpgrade postgresql-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade postgres-decoderbufsUpgrade pg_repack-debugsourceUpgrade postgresql-testUpgrade postgresql-plperl-debuginfo | Nov 30, 2023 | Aug 11, 2023 |
| Debian | — | Upgrade pgextwlistUpgrade postgresql-15 | Oct 5, 2023 | Aug 11, 2023 |
| Freebsd | — | Upgrade postgresql-server | Aug 11, 2023 | Aug 10, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-testUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresql-develUpgrade postgresql-pltcl | Jan 10, 2024 | Aug 11, 2023 |
| Oracle_linux | — | Upgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-testUpgrade postgresql-upgradeUpgrade postgres-decoderbufsUpgrade postgresql-private-libsUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade postgresql-private-develUpgrade pgauditUpgrade postgresql-staticUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-docsUpgrade pg_repack | Dec 1, 2023 | Aug 10, 2023 |
| Postgres | — | Upgrade to PostgreSQL version 15.4Upgrade to PostgreSQL version 14.9 | Aug 11, 2023 | Aug 11, 2023 |
| Redhat_linux | — | Upgrade postgresql-upgrade-develUpgrade postgresql-private-libsUpgrade pg_repack-debugsourceUpgrade postgresql-staticUpgrade postgresql-debugsourceUpgrade postgres-decoderbufsUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-testUpgrade postgresql-plpython3-debuginfoNo solution existsUpgrade postgresql-server-debuginfoUpgrade pgauditUpgrade postgresql-test-debuginfoUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-private-develUpgrade pgaudit-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade pg_repackUpgrade postgresql-plpython3Upgrade postgres-decoderbufs-debugsourceUpgrade pg_repack-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contrib | Nov 29, 2023 | Aug 11, 2023 |
| Rocky_linux | — | Upgrade postgresql-server-develUpgrade postgresql-plperlUpgrade pgauditUpgrade pg_repackUpgrade postgres-decoderbufsUpgrade postgresql-plpython3Upgrade postgresql-testUpgrade postgresql-upgradeUpgrade pgaudit-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-server-debuginfoUpgrade postgresqlUpgrade postgresql-docs-debuginfoUpgrade postgresql-debugsourceUpgrade pg_repack-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-pltclUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-docsUpgrade pg_repack-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-staticUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contribUpgrade postgresql-serverUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufs-debugsource | Mar 5, 2024 | Aug 11, 2023 |
| Suse | — | Upgrade postgresql13-testUpgrade postgresql14-plpythonUpgrade postgresql14-contribUpgrade postgresql13-llvmjit-develUpgrade postgresql12-develUpgrade postgresql14-server-develUpgrade postgresql12-docsUpgrade postgresql12-plperlUpgrade postgresql15-serverUpgrade postgresql12-serverUpgrade postgresql13-llvmjitUpgrade postgresql14-develUpgrade postgresql12-pltclUpgrade postgresql14Upgrade postgresql13-plperlUpgrade postgresql13-serverUpgrade libpq5-32bitUpgrade postgresql14-llvmjit-develUpgrade postgresql15-llvmjitUpgrade postgresql13Upgrade postgresql13-docsUpgrade postgresql14-plperlUpgrade postgresql15-contribUpgrade postgresql15-docsUpgrade postgresql12Upgrade postgresql14-serverUpgrade postgresql14-llvmjitUpgrade postgresql15-testUpgrade postgresql15-plperlUpgrade postgresql13-server-develUpgrade postgresql12-llvmjitUpgrade postgresql12-contribUpgrade libecpg6-32bitUpgrade postgresql13-plpythonUpgrade postgresql14-docsUpgrade postgresql13-develUpgrade postgresql12-server-develUpgrade libpq5Upgrade postgresql15-develUpgrade libecpg6Upgrade postgresql15-pltclUpgrade postgresql14-pltclUpgrade postgresql13-contribUpgrade postgresql14-testUpgrade postgresql12-llvmjit-develUpgrade postgresql15-server-develUpgrade postgresql15-llvmjit-develUpgrade postgresql13-pltclUpgrade postgresql12-plpythonUpgrade postgresql15Upgrade postgresql12-testUpgrade postgresql15-plpython | Aug 18, 2023 | Aug 11, 2023 |
| Ubuntu | — | Upgrade postgresql-client-15Upgrade postgresql-14Upgrade postgresql-client-12Upgrade postgresql-15Upgrade postgresql-client-14Upgrade postgresql-9.5 (Ubuntu Pro)Upgrade postgresql-client-9.5 (Ubuntu Pro)Upgrade postgresql-12 | Aug 18, 2023 | Aug 11, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub