A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-plpython3Upgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-upgradeUpgrade postgresql-serverUpgrade postgresql-private-libsUpgrade postgresql-server-develUpgrade postgresql-upgrade-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-private-develUpgrade postgres-decoderbufsUpgrade pg_repackUpgrade pgaudit | Dec 27, 2023 | Aug 11, 2023 |
| Alpine Linux | — | Upgrade postgresql13Upgrade postgresql12Upgrade postgresqlUpgrade postgresql15Upgrade postgresql14 | Aug 22, 2024 | Aug 11, 2023 |
| Amazon_linux_2023 | — | Upgrade postgresql15-testUpgrade postgresql15-private-libsUpgrade postgresql15-plpython3Upgrade postgresql15-contrib-debuginfoUpgrade postgresql15-upgrade-develUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql15-private-develUpgrade postgresql15-plperlUpgrade postgresql15-pltclUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-debugsourceUpgrade postgresql15-debuginfoUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-contribUpgrade postgresql15-docsUpgrade postgresql15-staticUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-test-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql15Upgrade postgresql15-server-develUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-llvmjitUpgrade postgresql15-serverUpgrade postgresql15-upgrade-devel-debuginfo | Feb 17, 2025 | Aug 10, 2023 |
| Centos_linux | — | Upgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade pg_repack-debuginfoUpgrade postgresql-upgradeUpgrade pg_repack-debugsourceUpgrade postgresql-plpython3Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufsUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-private-develUpgrade postgresql-contrib-debuginfoUpgrade pgauditUpgrade postgresql-debuginfoUpgrade postgresql-staticUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-debugsourceUpgrade pg_repackUpgrade postgresql-private-libsUpgrade pgaudit-debuginfoUpgrade postgresql-testUpgrade postgresql-server-develUpgrade postgresql-server-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-docsUpgrade postgresql-docs-debuginfo | Dec 14, 2023 | Aug 11, 2023 |
| Debian | — | Upgrade postgresql-15 | Nov 20, 2023 | Aug 11, 2023 |
| Freebsd | — | Upgrade postgresql-server | Aug 11, 2023 | Aug 10, 2023 |
| Oracle_linux | — | Upgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade pg_repackUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-server-develUpgrade postgresql-docsUpgrade postgresql-upgradeUpgrade postgresql-private-libsUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgresql-private-develUpgrade pgauditUpgrade postgres-decoderbufs | Dec 14, 2023 | Aug 10, 2023 |
| Postgres | — | Upgrade to PostgreSQL version 15.4Upgrade to the latest version of PostgreSQL | Aug 11, 2023 | Aug 11, 2023 |
| Redhat_linux | — | Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-plperlUpgrade postgres-decoderbufsUpgrade pg_repackUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-private-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade pgauditUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-pltcl-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade postgresql-testUpgrade postgresql-plpython3Upgrade postgresql-plpython3-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-develUpgrade postgresql-debuginfoUpgrade postgresql-debugsource | Dec 14, 2023 | Aug 11, 2023 |
| Rocky_linux | — | Upgrade pgauditUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufsUpgrade postgres-decoderbufs-debugsourceUpgrade pg_repack-debugsourceUpgrade pg_repack-debuginfoUpgrade pgaudit-debugsourceUpgrade pg_repack | Mar 5, 2024 | Aug 11, 2023 |
| Suse | — | Upgrade postgresql15-plperlUpgrade postgresql15-testUpgrade postgresql15-serverUpgrade libecpg6Upgrade postgresql15-docsUpgrade postgresql15-server-develUpgrade postgresql15-develUpgrade postgresql15-pltclUpgrade postgresql15-llvmjit-develUpgrade postgresql15-contribUpgrade postgresql15-llvmjitUpgrade libecpg6-32bitUpgrade libpq5-32bitUpgrade postgresql15Upgrade postgresql15-plpythonUpgrade libpq5 | Aug 18, 2023 | Aug 11, 2023 |
| Ubuntu | — | Upgrade postgresql-15Upgrade postgresql-client-15 | Aug 18, 2023 | Aug 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub