01 Record
CVE-2023-39418
Postgresql: merge fails to enforce update or select row security policies
LowPUBLISHEDCNA: redhat
CNA base score3.1 CVSS v3.xCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
02 Description
Postgresql: merge fails to enforce update or select row security policies
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.
- EPSS probability
- 1.08% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 64.9% of scored records. A rank, not a probability.
- NVD base score
- 4.3 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- Low. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2023-08-11 12:19Z3 YR AGO
- Last updated
- 2025-11-21 07:05Z11 MO AGO
- Reserved
- 2023-08-01
- Assigning CNA
- redhat
- Record state
- PUBLISHED
- Severity
- Low (CVSS 3.1)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-1220Insufficient Granularity of Access ControlBase
- Data version
- 5.2
- Document digest
- 58a7cd59a81d8656f6e3ffdcb58a74fbca0ea93c8bbef21d931d8e491410d490
05 Affected products
VendorProductVersionsPlatforms
06 References
- access.redhat.comRHSA-2023:7785https://access.redhat.com/errata/RHSA-2023:7785
- access.redhat.comRHSA-2023:7883https://access.redhat.com/errata/RHSA-2023:7883
- access.redhat.comRHSA-2023:7884https://access.redhat.com/errata/RHSA-2023:7884
- access.redhat.comRHSA-2023:7885https://access.redhat.com/errata/RHSA-2023:7885
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2023-39418
- bugzilla.redhat.comRHBZ#2228112https://bugzilla.redhat.com/show_bug.cgi?id=2228112
- git.postgresql.orghttps://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229
- www.postgresql.orghttps://www.postgresql.org/support/security/CVE-2023-39418/
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20230915-0002/
- www.debian.orghttps://www.debian.org/security/2023/dsa-5553
07 Fixed in
AlmaLinux 8
- pg_repack Fixed in 1.4.8-1.module_el8.8.0+3487+43ec1b9f
- pgaudit Fixed in 1.7.0-1.module_el8.8.0+3487+43ec1b9f
- postgres-decoderbufs Fixed in 1.9.7-1.Final.module_el8.8.0+3487+43ec1b9f
- postgresql Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-contrib Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-docs Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-plperl Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-plpython3 Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-pltcl Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-private-devel Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-private-libs Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-server Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-server-devel Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-static Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-test Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-test-rpm-macros Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-upgrade Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-upgrade-devel Fixed in 15.5-1.module_el8.9.0+3706+885c732e
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
AlmaLinux 9
- pg_repack Fixed in 1.4.8-1.module_el9.2.0+22+09653793
- pgaudit Fixed in 1.7.0-1.module_el9.2.0+22+09653793
- postgres-decoderbufs Fixed in 1.9.7-1.Final.module_el9.2.0+22+09653793
- postgresql Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-contrib Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-docs Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-plperl Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-plpython3 Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-pltcl Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-private-devel Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-private-libs Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-server Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-server-devel Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-static Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-test Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-test-rpm-macros Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-upgrade Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-upgrade-devel Fixed in 15.5-1.module_el9.3.0+52+21733919
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
CloudLinux 8
- pg_repack Fixed in 1.4.8-1.module_el8.8.0+3487+43ec1b9f
- pgaudit Fixed in 1.7.0-1.module_el8.8.0+3487+43ec1b9f
- postgres-decoderbufs Fixed in 1.9.7-1.Final.module_el8.8.0+3487+43ec1b9f
- postgresql Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-contrib Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-docs Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-plperl Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-plpython3 Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-pltcl Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-private-devel Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-private-libs Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-server Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-server-devel Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-static Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-test Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-test-rpm-macros Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-upgrade Fixed in 15.5-1.module_el8.9.0+3706+885c732e
- postgresql-upgrade-devel Fixed in 15.5-1.module_el8.9.0+3706+885c732e
Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
CloudLinux 9
- pg_repack Fixed in 1.4.8-1.module_el9.2.0+22+09653793
- pgaudit Fixed in 1.7.0-1.module_el9.2.0+22+09653793
- postgres-decoderbufs Fixed in 1.9.7-1.Final.module_el9.2.0+22+09653793
- postgresql Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-contrib Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-docs Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-plperl Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-plpython3 Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-pltcl Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-private-devel Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-private-libs Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-server Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-server-devel Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-static Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-test Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-test-rpm-macros Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-upgrade Fixed in 15.5-1.module_el9.3.0+52+21733919
- postgresql-upgrade-devel Fixed in 15.5-1.module_el9.3.0+52+21733919
Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
Debian 12
- postgresql-15 Fixed in 15.5-0+deb12u1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.