CVE-2023-39418

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-39418
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

3.1 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:7785 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7883 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7884 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7885 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-39418 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2228112 Issue Tracking Patch Third Party Advisory
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 Mailing List Patch
https://www.postgresql.org/support/security/CVE-2023-39418/ Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:7785 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7883 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7884 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7885 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-39418 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2228112 Issue Tracking Patch Third Party Advisory
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 Mailing List Patch
https://security.netapp.com/advisory/ntap-20230915-0002/
https://www.debian.org/security/2023/dsa-5553
https://www.postgresql.org/support/security/CVE-2023-39418/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
History

06 Dec 2024, 11:15

Type Values Removed Values Added
CWE CWE-1220

21 Nov 2024, 08:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20230915-0002/ -
  • () https://www.debian.org/security/2023/dsa-5553 -
References () https://access.redhat.com/errata/RHSA-2023:7785 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2023:7785 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7883 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2023:7883 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7884 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2023:7884 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7885 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2023:7885 - Third Party Advisory
References () https://access.redhat.com/security/cve/CVE-2023-39418 - Third Party Advisory () https://access.redhat.com/security/cve/CVE-2023-39418 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2228112 - Issue Tracking, Patch, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=2228112 - Issue Tracking, Patch, Third Party Advisory
References () https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 - Mailing List, Patch () https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 - Mailing List, Patch
References () https://www.postgresql.org/support/security/CVE-2023-39418/ - Vendor Advisory () https://www.postgresql.org/support/security/CVE-2023-39418/ - Vendor Advisory
CVSS v2 : unknown
v3 : 4.3 		v2 : unknown
v3 : 3.1

16 Sep 2024, 16:15

Type Values Removed Values Added
References
  • {'url': 'https://security.netapp.com/advisory/ntap-20230915-0002/', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://www.debian.org/security/2023/dsa-5553', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}

16 Feb 2024, 13:57

Type Values Removed Values Added
First Time Debian debian Linux
Debian
CPE cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
References () https://access.redhat.com/errata/RHSA-2023:7785 - () https://access.redhat.com/errata/RHSA-2023:7785 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7883 - () https://access.redhat.com/errata/RHSA-2023:7883 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7884 - () https://access.redhat.com/errata/RHSA-2023:7884 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7885 - () https://access.redhat.com/errata/RHSA-2023:7885 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20230915-0002/ - () https://security.netapp.com/advisory/ntap-20230915-0002/ - Third Party Advisory
References () https://www.debian.org/security/2023/dsa-5553 - () https://www.debian.org/security/2023/dsa-5553 - Third Party Advisory

20 Dec 2023, 15:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7883 -
  • () https://access.redhat.com/errata/RHSA-2023:7884 -
  • () https://access.redhat.com/errata/RHSA-2023:7885 -
Information

Published : 2023-08-11 13:15

Updated : 2024-12-06 11:15

NVD link : CVE-2023-39418

Mitre link : CVE-2023-39418

CVE.ORG link : CVE-2023-39418

JSON object : View

Products Affected

debian

  • debian_linux

postgresql

  • postgresql

redhat

  • enterprise_linux
CWE
CWE-1220

Insufficient Granularity of Access Control

NVD-CWE-noinfo