Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-39417

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

Published

2023-08-11T13:15:09.870

Last Modified

2024-11-21T08:15:22.817

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-89
  • Type: Primary
    CWE-89
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application postgresql postgresql < 11.21 Yes
Application postgresql postgresql < 12.16 Yes
Application postgresql postgresql < 13.12 Yes
Application postgresql postgresql < 14.9 Yes
Application postgresql postgresql < 15.4 Yes
Application redhat software_collections - Yes
Operating System redhat enterprise_linux 8.0 Yes
Operating System redhat enterprise_linux 9.0 Yes
Operating System debian debian_linux 8.0 Yes
Operating System debian debian_linux 11.0 Yes
Operating System debian debian_linux 12.0 Yes
References