A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-private-libsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-pltclUpgrade postgresql-upgrade-develUpgrade pgauditUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgres-decoderbufsUpgrade pg_repackUpgrade postgresql-private-develUpgrade postgresql-test | Dec 27, 2023 | Aug 11, 2023 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql13Upgrade postgresql12Upgrade postgresql14Upgrade postgresql15 | Aug 22, 2024 | Aug 11, 2023 |
| Amazon_linux_2023 | — | Upgrade postgresql15-plperlUpgrade postgresql15-contribUpgrade postgresql15-private-develUpgrade postgresql15-pltclUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-debuginfoUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-testUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-private-libsUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-upgrade-develUpgrade postgresql15-plpython3Upgrade postgresql15-debugsourceUpgrade postgresql15-staticUpgrade postgresql15-test-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql15-server-develUpgrade postgresql15Upgrade postgresql15-docsUpgrade postgresql15-serverUpgrade postgresql15-llvmjitUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-server-devel-debuginfo | Feb 17, 2025 | Aug 10, 2023 |
| Centos_linux | — | Upgrade pgaudit-debugsourceUpgrade postgresql-debugsourceUpgrade postgresql-test-debuginfoUpgrade pg_repackUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-docs-debuginfoUpgrade postgresql-docsUpgrade postgresql-server-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-testUpgrade pgaudit-debuginfoUpgrade postgresql-plperlUpgrade postgresql-private-libsUpgrade postgresql-server-develUpgrade postgres-decoderbufs-debugsourceUpgrade postgres-decoderbufsUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contribUpgrade postgresql-plperl-debuginfoUpgrade postgresql-plpython3Upgrade pg_repack-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-debuginfoUpgrade postgresql-staticUpgrade postgresql-private-libs-debuginfoUpgrade pgauditUpgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgresql-private-develUpgrade pg_repack-debugsourceUpgrade postgresql-pltcl-debuginfo | Dec 14, 2023 | Aug 11, 2023 |
| Debian | — | Upgrade postgresql-15 | Nov 20, 2023 | Aug 11, 2023 |
| Freebsd | — | Upgrade postgresql-server | Aug 11, 2023 | Aug 10, 2023 |
| Oracle_linux | — | Upgrade postgresql-staticUpgrade postgresql-upgradeUpgrade postgres-decoderbufsUpgrade postgresql-upgrade-develUpgrade postgresql-docsUpgrade postgresql-private-develUpgrade pgauditUpgrade postgresql-private-libsUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade pg_repackUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-plpython3Upgrade postgresql-server | Dec 14, 2023 | Aug 10, 2023 |
| Postgres | — | Upgrade to PostgreSQL version 15.4 | Aug 11, 2023 | Aug 11, 2023 |
| Redhat_linux | — | Upgrade postgresql-server-devel-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-testUpgrade pg_repack-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade pgaudit-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-private-libsUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgres-decoderbufsUpgrade postgresql-plperlUpgrade postgresql-private-develUpgrade postgresql-contribUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-docsUpgrade pgauditUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-serverUpgrade postgresql-test-debuginfoUpgrade postgresql-staticUpgrade pg_repackUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-test-rpm-macros | Dec 14, 2023 | Aug 11, 2023 |
| Rocky_linux | — | Upgrade pgaudit-debugsourceUpgrade pg_repackUpgrade pgaudit-debuginfoUpgrade pgauditUpgrade pg_repack-debuginfoUpgrade postgres-decoderbufsUpgrade postgres-decoderbufs-debuginfoUpgrade pg_repack-debugsourceUpgrade postgres-decoderbufs-debugsource | Mar 5, 2024 | Aug 11, 2023 |
| Suse | — | Upgrade postgresql15-develUpgrade postgresql15-testUpgrade postgresql15-docsUpgrade libecpg6Upgrade postgresql15-plperlUpgrade postgresql15-serverUpgrade postgresql15-server-develUpgrade libecpg6-32bitUpgrade postgresql15-llvmjit-develUpgrade libpq5-32bitUpgrade postgresql15-llvmjitUpgrade libpq5Upgrade postgresql15-contribUpgrade postgresql15-pltclUpgrade postgresql15Upgrade postgresql15-plpython | Aug 18, 2023 | Aug 11, 2023 |
| Ubuntu | — | Upgrade postgresql-15Upgrade postgresql-client-15 | Aug 18, 2023 | Aug 11, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 20, 2026 | Aug 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub