CVE-2023-39418

A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2023:7785	Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7883	Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7884	Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7885	Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-39418	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2228112	Issue Tracking Patch Third Party Advisory
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229	Mailing List Patch
https://www.postgresql.org/support/security/CVE-2023-39418/	Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:7785	Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7883	Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7884	Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7885	Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-39418	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2228112	Issue Tracking Patch Third Party Advisory
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229	Mailing List Patch
https://security.netapp.com/advisory/ntap-20230915-0002/
https://www.debian.org/security/2023/dsa-5553
https://www.postgresql.org/support/security/CVE-2023-39418/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

History

06 Dec 2024, 11:15

Type	Values Removed	Values Added
CWE		CWE-1220

21 Nov 2024, 08:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~4.3~~	v2 : unknown v3 : 3.1
References		() https://security.netapp.com/advisory/ntap-20230915-0002/ - () https://www.debian.org/security/2023/dsa-5553 -
References	~~() https://access.redhat.com/errata/RHSA-2023:7785 - Third Party Advisory~~	() https://access.redhat.com/errata/RHSA-2023:7785 - Third Party Advisory
References	~~() https://access.redhat.com/errata/RHSA-2023:7883 - Third Party Advisory~~	() https://access.redhat.com/errata/RHSA-2023:7883 - Third Party Advisory
References	~~() https://access.redhat.com/errata/RHSA-2023:7884 - Third Party Advisory~~	() https://access.redhat.com/errata/RHSA-2023:7884 - Third Party Advisory
References	~~() https://access.redhat.com/errata/RHSA-2023:7885 - Third Party Advisory~~	() https://access.redhat.com/errata/RHSA-2023:7885 - Third Party Advisory
References	~~() https://access.redhat.com/security/cve/CVE-2023-39418 - Third Party Advisory~~	() https://access.redhat.com/security/cve/CVE-2023-39418 - Third Party Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2228112 - Issue Tracking, Patch, Third Party Advisory~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2228112 - Issue Tracking, Patch, Third Party Advisory
References	~~() https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 - Mailing List, Patch~~	() https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 - Mailing List, Patch
References	~~() https://www.postgresql.org/support/security/CVE-2023-39418/ - Vendor Advisory~~	() https://www.postgresql.org/support/security/CVE-2023-39418/ - Vendor Advisory

16 Sep 2024, 16:15

Type	Values Removed	Values Added
References	~~{'url': 'https://security.netapp.com/advisory/ntap-20230915-0002/', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}~~ ~~{'url': 'https://www.debian.org/security/2023/dsa-5553', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}~~

16 Feb 2024, 13:57

Type	Values Removed	Values Added
References	~~() https://access.redhat.com/errata/RHSA-2023:7785 -~~	() https://access.redhat.com/errata/RHSA-2023:7785 - Third Party Advisory
References	~~() https://access.redhat.com/errata/RHSA-2023:7883 -~~	() https://access.redhat.com/errata/RHSA-2023:7883 - Third Party Advisory
References	~~() https://access.redhat.com/errata/RHSA-2023:7884 -~~	() https://access.redhat.com/errata/RHSA-2023:7884 - Third Party Advisory
References	~~() https://access.redhat.com/errata/RHSA-2023:7885 -~~	() https://access.redhat.com/errata/RHSA-2023:7885 - Third Party Advisory
References	~~() https://security.netapp.com/advisory/ntap-20230915-0002/ -~~	() https://security.netapp.com/advisory/ntap-20230915-0002/ - Third Party Advisory
References	~~() https://www.debian.org/security/2023/dsa-5553 -~~	() https://www.debian.org/security/2023/dsa-5553 - Third Party Advisory
First Time		Debian Debian debian Linux
CPE		cpe:2.3:o:debian:debian_linux:12.0:::::::*

20 Dec 2023, 15:15

Type	Values Removed	Values Added
References		() https://access.redhat.com/errata/RHSA-2023:7883 - () https://access.redhat.com/errata/RHSA-2023:7884 - () https://access.redhat.com/errata/RHSA-2023:7885 -

13 Dec 2023, 22:15

Type	Values Removed	Values Added
References		() https://www.debian.org/security/2023/dsa-5553 - () https://access.redhat.com/errata/RHSA-2023:7785 - (MISC) https://security.netapp.com/advisory/ntap-20230915-0002/ -

18 Aug 2023, 17:38

Type	Values Removed	Values Added
CPE		cpe:2.3:o:redhat:enterprise_linux:9.0:::::::* cpe:2.3:a:postgresql:postgresql:::::::: cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
CWE		NVD-CWE-noinfo
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
References	~~(MISC) https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 -~~	(MISC) https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 - Mailing List, Patch
References	~~(MISC) https://access.redhat.com/security/cve/CVE-2023-39418 -~~	(MISC) https://access.redhat.com/security/cve/CVE-2023-39418 - Third Party Advisory
References	~~(MISC) https://www.postgresql.org/support/security/CVE-2023-39418/ -~~	(MISC) https://www.postgresql.org/support/security/CVE-2023-39418/ - Vendor Advisory
References	~~(MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2228112 -~~	(MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2228112 - Issue Tracking, Patch, Third Party Advisory

11 Aug 2023, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-08-11 13:15

Updated : 2024-12-06 11:15

NVD link : CVE-2023-39418

Mitre link : CVE-2023-39418

CVE.ORG link : CVE-2023-39418

JSON object : View

Products Affected

debian

debian_linux

postgresql

postgresql

redhat

enterprise_linux

CWE

CWE-1220

Insufficient Granularity of Access Control

NVD-CWE-noinfo

3.1 /10