CVE-2023-39418

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-39418
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:7785 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7883 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7884 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7885 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-39418 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2228112 Issue Tracking Patch Third Party Advisory
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 Mailing List Patch
https://security.netapp.com/advisory/ntap-20230915-0002/ Third Party Advisory
https://www.debian.org/security/2023/dsa-5553 Third Party Advisory
https://www.postgresql.org/support/security/CVE-2023-39418/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
History

16 Feb 2024, 13:57

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2023:7785 - () https://access.redhat.com/errata/RHSA-2023:7785 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7883 - () https://access.redhat.com/errata/RHSA-2023:7883 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7884 - () https://access.redhat.com/errata/RHSA-2023:7884 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7885 - () https://access.redhat.com/errata/RHSA-2023:7885 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20230915-0002/ - () https://security.netapp.com/advisory/ntap-20230915-0002/ - Third Party Advisory
References () https://www.debian.org/security/2023/dsa-5553 - () https://www.debian.org/security/2023/dsa-5553 - Third Party Advisory
First Time Debian
Debian debian Linux
CPE cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

20 Dec 2023, 15:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7883 -
  • () https://access.redhat.com/errata/RHSA-2023:7884 -
  • () https://access.redhat.com/errata/RHSA-2023:7885 -

13 Dec 2023, 22:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7785 -

14 Nov 2023, 14:15

Type Values Removed Values Added
References
  • () https://www.debian.org/security/2023/dsa-5553 -

15 Sep 2023, 14:15

Type Values Removed Values Added
References
  • (MISC) https://security.netapp.com/advisory/ntap-20230915-0002/ -

18 Aug 2023, 17:38

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3
CWE NVD-CWE-noinfo
First Time Postgresql postgresql
Redhat enterprise Linux
Postgresql
Redhat
CPE cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
References (MISC) https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 - (MISC) https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 - Mailing List, Patch
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2228112 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2228112 - Issue Tracking, Patch, Third Party Advisory
References (MISC) https://www.postgresql.org/support/security/CVE-2023-39418/ - (MISC) https://www.postgresql.org/support/security/CVE-2023-39418/ - Vendor Advisory
References (MISC) https://access.redhat.com/security/cve/CVE-2023-39418 - (MISC) https://access.redhat.com/security/cve/CVE-2023-39418 - Third Party Advisory

11 Aug 2023, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-08-11 13:15

Updated : 2024-02-16 13:57

NVD link : CVE-2023-39418

Mitre link : CVE-2023-39418

CVE.ORG link : CVE-2023-39418

JSON object : View

Products Affected

debian

  • debian_linux

redhat

  • enterprise_linux

postgresql

  • postgresql
CWE
NVD-CWE-noinfo