CVE-2023-39417

HIGH8.8EPSS 0.66%

postgresql-11 - security update

Published: 8/11/2023Modified: 3/9/2026

Also known as:ALPINE-CVE-2023-39417DEBIAN-CVE-2023-39417DLA-3600-1

Description

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

Affected packages (10)

Alpine/postgresqlfrom 0, < 13.12-r0
Alpine/postgresql13from 0, < 13.12-r0
Alpine/postgresql14from 0, < 14.9-r0
Alpine/postgresql15from 0, < 15.4-r0
Bitnami/postgresql>= 11.0.0, < 11.21.0, >= 12.0.0, < 12.16.0, >= 13.0.0, < 13.12.0, >= 14.0.0, < 14.9.0, >= 15.0.0, < 15.4.0
Debian/postgresql-11from 0, < 11.21-0+deb10u2
Debian/postgresql-13from 0, < 13.13-0+deb11u1
Debian/postgresql-13from 0, < 13.13-0+deb11u1
Debian/postgresql-15from 0, < 15.5-0+deb12u1
Debian/postgresql-15from 0, < 15.5-0+deb12u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Affected packages (10)

CVSS scores

References (31)