Skip to content
CVE PROGRAM SOURCE RECORD3.1 Low

CVE-2023-39418

Postgresql: merge fails to enforce update or select row security policies

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 8090020231114113548.a75119d5 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support

Default version status: affected

  • 8080020231113134015.63b34585 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 9030020231120082734.rhel9 to < *unaffected

Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support

Default version status: affected

  • 9020020231115020618.rhel9 to < *unaffected

Red Hat Red Hat Enterprise Linux 6

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 7

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: unaffected

Red Hat Red Hat Software Collections

Default version status: unaffected

Red Hat Red Hat Software Collections

Default version status: unaffected

Red Hat Red Hat Software Collections

Default version status: unaffected

References