CVE-2023-39417

HIGH8.8EPSS 0.66%

postgresql-11 - security update

發布日:2023/8/11修改日:2026/3/9

也稱為:ALPINE-CVE-2023-39417DEBIAN-CVE-2023-39417DLA-3600-1

描述

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

受影響套件(10)

Alpine/postgresqlfrom 0, < 13.12-r0
Alpine/postgresql13from 0, < 13.12-r0
Alpine/postgresql14from 0, < 14.9-r0
Alpine/postgresql15from 0, < 15.4-r0
Bitnami/postgresql>= 11.0.0, < 11.21.0, >= 12.0.0, < 12.16.0, >= 13.0.0, < 13.12.0, >= 14.0.0, < 14.9.0, >= 15.0.0, < 15.4.0
Debian/postgresql-11from 0, < 11.21-0+deb10u2
Debian/postgresql-13from 0, < 13.13-0+deb11u1
Debian/postgresql-13from 0, < 13.13-0+deb11u1
Debian/postgresql-15from 0, < 15.5-0+deb12u1
Debian/postgresql-15from 0, < 15.5-0+deb12u1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

描述

受影響套件(10)

CVSS 分數

參考連結(31)