CVE-2023-39418

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-39418
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

4.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:7785 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7785 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7883 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7883 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7884 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7884 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7885 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7885 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-39418 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-39418 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2228112 Issue Tracking Patch Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2228112 Issue Tracking Patch Third Party Advisory
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 Mailing List Patch
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 Mailing List Patch
https://security.netapp.com/advisory/ntap-20230915-0002/
https://www.debian.org/security/2023/dsa-5553
https://www.postgresql.org/support/security/CVE-2023-39418/ Vendor Advisory
https://www.postgresql.org/support/security/CVE-2023-39418/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
History

06 Dec 2024, 11:15

Type Values Removed Values Added
CWE NVD-CWE-noinfo CWE-1220
References
  • () https://security.netapp.com/advisory/ntap-20230915-0002/ -
  • () https://www.debian.org/security/2023/dsa-5553 -
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2228112 - Issue Tracking, Patch, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=2228112 - Issue Tracking, Patch, Third Party Advisory
References (MISC) https://www.postgresql.org/support/security/CVE-2023-39418/ - Vendor Advisory () https://www.postgresql.org/support/security/CVE-2023-39418/ - Vendor Advisory
References (MISC) https://access.redhat.com/security/cve/CVE-2023-39418 - Third Party Advisory () https://access.redhat.com/security/cve/CVE-2023-39418 - Third Party Advisory
References (MISC) https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 - Mailing List, Patch () https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 - Mailing List, Patch

16 Sep 2024, 16:15

Type Values Removed Values Added
References
  • {'url': 'https://security.netapp.com/advisory/ntap-20230915-0002/', 'name': 'https://security.netapp.com/advisory/ntap-20230915-0002/', 'tags': ['Third Party Advisory'], 'refsource': 'MISC'}
  • {'url': 'https://www.debian.org/security/2023/dsa-5553', 'name': 'https://www.debian.org/security/2023/dsa-5553', 'tags': ['Third Party Advisory'], 'refsource': ''}

16 Feb 2024, 13:57

Type Values Removed Values Added
References (MISC) https://security.netapp.com/advisory/ntap-20230915-0002/ - (MISC) https://security.netapp.com/advisory/ntap-20230915-0002/ - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7785 - () https://access.redhat.com/errata/RHSA-2023:7785 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7884 - () https://access.redhat.com/errata/RHSA-2023:7884 - Third Party Advisory
References () https://www.debian.org/security/2023/dsa-5553 - () https://www.debian.org/security/2023/dsa-5553 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7883 - () https://access.redhat.com/errata/RHSA-2023:7883 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7885 - () https://access.redhat.com/errata/RHSA-2023:7885 - Third Party Advisory
First Time Debian
Debian debian Linux
CPE cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

20 Dec 2023, 15:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7884 -
  • () https://access.redhat.com/errata/RHSA-2023:7883 -
  • () https://access.redhat.com/errata/RHSA-2023:7885 -

13 Dec 2023, 22:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7785 -

14 Nov 2023, 14:15

Type Values Removed Values Added
References
  • (MISC) https://security.netapp.com/advisory/ntap-20230915-0002/ -
  • () https://www.debian.org/security/2023/dsa-5553 -

18 Aug 2023, 17:38

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3
CWE NVD-CWE-noinfo
First Time Redhat
Postgresql
Postgresql postgresql
Redhat enterprise Linux
CPE cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
References (MISC) https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 - (MISC) https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 - Mailing List, Patch
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2228112 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2228112 - Issue Tracking, Patch, Third Party Advisory
References (MISC) https://access.redhat.com/security/cve/CVE-2023-39418 - (MISC) https://access.redhat.com/security/cve/CVE-2023-39418 - Third Party Advisory
References (MISC) https://www.postgresql.org/support/security/CVE-2023-39418/ - (MISC) https://www.postgresql.org/support/security/CVE-2023-39418/ - Vendor Advisory

11 Aug 2023, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-08-11 13:15

Updated : 2024-12-06 11:15

NVD link : CVE-2023-39418

Mitre link : CVE-2023-39418

JSON object : View

Products Affected

postgresql

  • postgresql

redhat

  • enterprise_linux

debian

  • debian_linux
CWE
CWE-1220

Insufficient Granularity of Access Control