CVE-2023-39418
Postgresql: merge fails to enforce update or select row security policies
- State
- Published
- Severity
- 3.1 Low
- Published
- Aug 11, 2023
- Updated
- Nov 21, 2025
- Reserved
- Aug 1, 2023
Description
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.1 Low | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N | redhat |
Weaknesses
- CWE-1220 Insufficient Granularity of Access Control
Affected Products
| Product | Versions |
|---|---|
Red Hat Enterprise Linux 8Red Hat |
|
Red Hat Enterprise Linux 8.8 Extended Update SupportRed Hat |
|
Red Hat Enterprise Linux 9Red Hat |
|
Red Hat Enterprise Linux 9.2 Extended Update SupportRed Hat |
|
Red Hat Enterprise Linux 6Red Hat | |
Red Hat Enterprise Linux 7Red Hat | |
Red Hat Enterprise Linux 8Red Hat | |
Red Hat Enterprise Linux 8Red Hat | |
Red Hat Enterprise Linux 8Red Hat | |
Red Hat Enterprise Linux 9Red Hat | |
Red Hat Software CollectionsRed Hat | |
Red Hat Software CollectionsRed Hat | |
Red Hat Software CollectionsRed Hat |
References
- RHSA-2023:7785vendor-advisory
- RHSA-2023:7883vendor-advisory
- RHSA-2023:7884vendor-advisory
- RHSA-2023:7885vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-39418vdb-entry
- RHBZ#2228112issue-tracking
- https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229
- https://www.postgresql.org/support/security/CVE-2023-39418/
- https://security.netapp.com/advisory/ntap-20230915-0002/
- https://www.debian.org/security/2023/dsa-5553
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.