A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-testUpgrade postgresql-private-develUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresqlUpgrade pg_repackUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgresql-docsUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-private-libsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plpython3Upgrade postgresql-serverUpgrade postgresql-upgrade-devel | Dec 27, 2023 | Aug 11, 2023 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql13Upgrade postgresql12Upgrade postgresql14Upgrade postgresql15 | Aug 22, 2024 | Aug 11, 2023 |
| Amazon_linux_2023 | — | Upgrade postgresql15-debugsourceUpgrade postgresql15-testUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-debuginfoUpgrade postgresql15-plperlUpgrade postgresql15-server-debuginfoUpgrade postgresql15-private-libsUpgrade postgresql15-private-develUpgrade postgresql15-contribUpgrade postgresql15-plpython3Upgrade postgresql15-test-rpm-macrosUpgrade postgresql15-upgrade-develUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-pltclUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-docsUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-serverUpgrade postgresql15-llvmjitUpgrade postgresql15-test-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql15Upgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-server-develUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-static | Feb 17, 2025 | Aug 10, 2023 |
| Centos_linux | — | Upgrade postgres-decoderbufs-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-private-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-staticUpgrade postgresql-upgradeUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade pg_repack-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade pgauditUpgrade postgresql-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plpython3Upgrade pgaudit-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-docs-debuginfoUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-server-develUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-server-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-docsUpgrade pg_repackUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-plperl | Dec 14, 2023 | Aug 11, 2023 |
| Debian | — | Upgrade postgresql-15 | Nov 20, 2023 | Aug 11, 2023 |
| Freebsd | — | Upgrade postgresql-server | Aug 11, 2023 | Aug 10, 2023 |
| Oracle_linux | — | Upgrade postgresql-server-develUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-plpython3Upgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgres-decoderbufsUpgrade postgresql-private-develUpgrade postgresql-staticUpgrade postgresql-docsUpgrade pgauditUpgrade postgresql-private-libsUpgrade postgresql-upgradeUpgrade postgresql-upgrade-develUpgrade postgresql-test-rpm-macrosUpgrade pg_repack | Dec 14, 2023 | Aug 10, 2023 |
| Postgres | — | Upgrade to PostgreSQL version 15.4 | Aug 11, 2023 | Aug 11, 2023 |
| Redhat_linux | — | Upgrade postgresql-testUpgrade postgresql-private-libsUpgrade pg_repack-debugsourceUpgrade postgresql-debugsourceUpgrade postgresql-plpython3Upgrade postgresql-pltcl-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-upgrade-develUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade pg_repack-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-private-develUpgrade postgresql-pltclUpgrade pg_repackUpgrade postgresql-staticUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresqlUpgrade postgresql-contribUpgrade pgaudit | Dec 14, 2023 | Aug 11, 2023 |
| Rocky_linux | — | Upgrade pg_repack-debuginfoUpgrade pgaudit-debuginfoUpgrade pg_repack-debugsourceUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade postgres-decoderbufsUpgrade pg_repackUpgrade pgaudit-debugsource | Mar 5, 2024 | Aug 11, 2023 |
| Suse | — | Upgrade postgresql15-llvmjitUpgrade postgresql15-llvmjit-develUpgrade libpq5Upgrade libecpg6-32bitUpgrade postgresql15-plpythonUpgrade postgresql15-pltclUpgrade postgresql15Upgrade libpq5-32bitUpgrade postgresql15-contribUpgrade postgresql15-serverUpgrade postgresql15-testUpgrade postgresql15-develUpgrade postgresql15-server-develUpgrade postgresql15-docsUpgrade postgresql15-plperlUpgrade libecpg6 | Aug 18, 2023 | Aug 11, 2023 |
| Ubuntu | — | Upgrade postgresql-client-15Upgrade postgresql-15 | Aug 18, 2023 | Aug 11, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 20, 2026 | Aug 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub