CVE-2023-39417

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-39417
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:7545 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7579 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7580 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7581 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7616 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7656 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7666 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7667 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7694 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7695 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7714 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7770 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7772 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7784 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7785 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7883 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7884 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7885 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0304 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0332 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0337 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-39417 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2228111 Issue Tracking Third Party Advisory
https://www.postgresql.org/support/security/CVE-2023-39417 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
History

09 Sep 2024, 08:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2023/10/msg00003.html', 'tags': ['Mailing List'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://security.netapp.com/advisory/ntap-20230915-0002/', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://www.debian.org/security/2023/dsa-5553', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://www.debian.org/security/2023/dsa-5554', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}

16 Feb 2024, 15:20

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2023:7545 - () https://access.redhat.com/errata/RHSA-2023:7545 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7579 - () https://access.redhat.com/errata/RHSA-2023:7579 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7580 - () https://access.redhat.com/errata/RHSA-2023:7580 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7581 - () https://access.redhat.com/errata/RHSA-2023:7581 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7616 - () https://access.redhat.com/errata/RHSA-2023:7616 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7656 - () https://access.redhat.com/errata/RHSA-2023:7656 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7666 - () https://access.redhat.com/errata/RHSA-2023:7666 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7667 - () https://access.redhat.com/errata/RHSA-2023:7667 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7694 - () https://access.redhat.com/errata/RHSA-2023:7694 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7695 - () https://access.redhat.com/errata/RHSA-2023:7695 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7714 - () https://access.redhat.com/errata/RHSA-2023:7714 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7770 - () https://access.redhat.com/errata/RHSA-2023:7770 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7772 - () https://access.redhat.com/errata/RHSA-2023:7772 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7784 - () https://access.redhat.com/errata/RHSA-2023:7784 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7785 - () https://access.redhat.com/errata/RHSA-2023:7785 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7883 - () https://access.redhat.com/errata/RHSA-2023:7883 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7884 - () https://access.redhat.com/errata/RHSA-2023:7884 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7885 - () https://access.redhat.com/errata/RHSA-2023:7885 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:0304 - () https://access.redhat.com/errata/RHSA-2024:0304 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:0332 - () https://access.redhat.com/errata/RHSA-2024:0332 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:0337 - () https://access.redhat.com/errata/RHSA-2024:0337 - Third Party Advisory
References () https://www.debian.org/security/2023/dsa-5553 - () https://www.debian.org/security/2023/dsa-5553 - Third Party Advisory
References () https://www.debian.org/security/2023/dsa-5554 - () https://www.debian.org/security/2023/dsa-5554 - Third Party Advisory
CPE cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

25 Jan 2024, 09:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:0337 -

22 Jan 2024, 21:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:0332 -
  • () https://access.redhat.com/errata/RHSA-2024:0304 -

20 Dec 2023, 15:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7883 -
  • () https://access.redhat.com/errata/RHSA-2023:7884 -
  • () https://access.redhat.com/errata/RHSA-2023:7885 -

13 Dec 2023, 22:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7785 -
  • () https://access.redhat.com/errata/RHSA-2023:7784 -

13 Dec 2023, 10:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7770 -
  • () https://access.redhat.com/errata/RHSA-2023:7772 -

11 Dec 2023, 16:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7714 -

07 Dec 2023, 10:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7695 -
  • () https://access.redhat.com/errata/RHSA-2023:7694 -

06 Dec 2023, 16:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7667 -
  • () https://access.redhat.com/errata/RHSA-2023:7666 -

05 Dec 2023, 22:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7656 -

30 Nov 2023, 18:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7616 -

29 Nov 2023, 18:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7579 -
  • () https://access.redhat.com/errata/RHSA-2023:7580 -
  • () https://access.redhat.com/errata/RHSA-2023:7581 -

28 Nov 2023, 18:15

Type Values Removed Values Added
References
  • (MISC) https://lists.debian.org/debian-lts-announce/2023/10/msg00003.html - Mailing List
  • (MISC) https://security.netapp.com/advisory/ntap-20230915-0002/ - Third Party Advisory
  • () https://access.redhat.com/errata/RHSA-2023:7545 -
  • () https://www.debian.org/security/2023/dsa-5553 -
  • () https://www.debian.org/security/2023/dsa-5554 -
CPE cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

18 Aug 2023, 17:58

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
References (MISC) https://access.redhat.com/security/cve/CVE-2023-39417 - (MISC) https://access.redhat.com/security/cve/CVE-2023-39417 - Third Party Advisory
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2228111 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2228111 - Issue Tracking, Third Party Advisory
References (MISC) https://www.postgresql.org/support/security/CVE-2023-39417 - (MISC) https://www.postgresql.org/support/security/CVE-2023-39417 - Vendor Advisory
CPE cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*
CWE CWE-89

11 Aug 2023, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-08-11 13:15

Updated : 2024-09-09 08:15

NVD link : CVE-2023-39417

Mitre link : CVE-2023-39417

CVE.ORG link : CVE-2023-39417

JSON object : View

Products Affected

postgresql

  • postgresql

redhat

  • software_collections
  • enterprise_linux

debian

  • debian_linux
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')