A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-serverUpgrade postgresql-upgrade-develUpgrade postgresql-pltclUpgrade postgresql-private-libsUpgrade postgresql-server-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade pg_repackUpgrade postgresql-testUpgrade pgauditUpgrade postgresqlUpgrade postgresql-private-develUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgres-decoderbufs | Dec 27, 2023 | Aug 11, 2023 |
| Alpine Linux | — | Upgrade postgresql13Upgrade postgresqlUpgrade postgresql12Upgrade postgresql14Upgrade postgresql15 | Aug 22, 2024 | Aug 11, 2023 |
| Amazon_linux_2023 | — | Upgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-llvmjitUpgrade postgresql15-serverUpgrade postgresql15-docsUpgrade postgresql15Upgrade postgresql15-server-develUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-test-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql15-staticUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-contribUpgrade postgresql15-debugsourceUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-testUpgrade postgresql15-pltclUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-plpython3Upgrade postgresql15-debuginfoUpgrade postgresql15-private-libsUpgrade postgresql15-server-debuginfoUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-plperlUpgrade postgresql15-private-develUpgrade postgresql15-upgrade-devel | Feb 17, 2025 | Aug 10, 2023 |
| Centos_linux | — | Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-plperlUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-serverUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade pgaudit-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-test-debuginfoUpgrade postgresqlUpgrade pgaudit-debugsourceUpgrade postgresql-debugsourceUpgrade pg_repackUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgauditUpgrade postgresql-debuginfoUpgrade postgresql-contribUpgrade pg_repack-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-plperl-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-staticUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade postgresql-private-develUpgrade pg_repack-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-pltcl-debuginfo | Dec 14, 2023 | Aug 11, 2023 |
| Debian | — | Upgrade postgresql-15 | Nov 20, 2023 | Aug 11, 2023 |
| Freebsd | — | Upgrade postgresql-server | Aug 11, 2023 | Aug 10, 2023 |
| Oracle_linux | — | Upgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-pltclUpgrade postgresql-plperlUpgrade pg_repackUpgrade postgresqlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-testUpgrade postgresql-contribUpgrade postgresql-private-libsUpgrade pgauditUpgrade postgresql-upgradeUpgrade postgresql-private-develUpgrade postgresql-staticUpgrade postgres-decoderbufsUpgrade postgresql-upgrade-develUpgrade postgresql-docs | Dec 14, 2023 | Aug 10, 2023 |
| Postgres | — | Upgrade to PostgreSQL version 15.4 | Aug 11, 2023 | Aug 11, 2023 |
| Redhat_linux | — | Upgrade postgresql-contrib-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-testUpgrade postgresql-server-develUpgrade postgresql-server-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-upgradeUpgrade pgaudit-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-develUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade pg_repackUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgres-decoderbufsUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-staticUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-private-develUpgrade postgresql-plperlUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-serverUpgrade postgresql-private-libs-debuginfoUpgrade pgauditUpgrade postgresql-contrib | Dec 14, 2023 | Aug 11, 2023 |
| Rocky_linux | — | Upgrade pgaudit-debugsourceUpgrade pg_repackUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgres-decoderbufs-debugsourceUpgrade pg_repack-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debuginfoUpgrade pg_repack-debugsource | Mar 5, 2024 | Aug 11, 2023 |
| Suse | — | Upgrade libecpg6Upgrade postgresql15-plperlUpgrade postgresql15-testUpgrade postgresql15-serverUpgrade postgresql15-docsUpgrade postgresql15-server-develUpgrade postgresql15-develUpgrade postgresql15-pltclUpgrade postgresql15-plpythonUpgrade libecpg6-32bitUpgrade postgresql15-contribUpgrade postgresql15-llvmjit-develUpgrade libpq5Upgrade postgresql15-llvmjitUpgrade libpq5-32bitUpgrade postgresql15 | Aug 18, 2023 | Aug 11, 2023 |
| Ubuntu | — | Upgrade postgresql-15Upgrade postgresql-client-15 | Aug 18, 2023 | Aug 11, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 20, 2026 | Aug 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub