Postgresql: extension script @substitutions@ within quoting allow sql injection
Priority MEDIUM 43CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 20 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-89.
Summary
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01676 77th percentileScored 2026-11-07
Fix Partial Red Hat: 21 advisoriesRed Hat: 20 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Advanced Cluster Security 4.2 | — | 4.2.4-6 | Patch available | CNA |
| Red Hat | Red Hat Advanced Cluster Security 4.2 | — | 4.2.4-6 | Patch available | CNA |
| Red Hat | Red Hat Advanced Cluster Security 4.2 | — | 4.2.4-7 | Patch available | CNA |
| Red Hat | Red Hat Advanced Cluster Security 4.2 | — | 4.2.4-6 | Patch available | CNA |
| Red Hat | Red Hat Advanced Cluster Security 4.2 | — | 4.2.4-7 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 8090020231114113712.a75119d5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 8090020231128173330.a75119d5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 8090020231114113548.a75119d5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | 8020020231128165246.4cda2c84 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Telecommunications Update Service | — | 8020020231128165246.4cda2c84 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions | — | 8020020231128165246.4cda2c84 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 8040020231127153301.522a0ee4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 8040020231127154806.522a0ee4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — | 8040020231127153301.522a0ee4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — | 8040020231127154806.522a0ee4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | 8040020231127153301.522a0ee4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | 8040020231127154806.522a0ee4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | — | 8060020231114115246.ad008a3a | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | — | 8060020231128165328.ad008a3a | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | 8080020231114105206.63b34585 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | 8080020231128165335.63b34585 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | 8080020231113134015.63b34585 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 13.13-1.el9_3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 9030020231120082734.rhel9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | — | 13.13-1.el9_0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | 13.13-1.el9_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | 9020020231115020618.rhel9 | Patch available | CNA |
| Red Hat | Red Hat Software Collections for Red Hat Enterprise Linux 7 | — | 12.17-1.el7 | Patch available | CNA |
| Red Hat | Red Hat Software Collections for Red Hat Enterprise Linux 7 | — | 13.13-1.el7 | Patch available | CNA |
| Red Hat | RHACS-3.74-RHEL-8 | — | 3.74.8-9 | Patch available | CNA |
| Red Hat | RHACS-3.74-RHEL-8 | — | 3.74.8-9 | Patch available | CNA |
| Red Hat | RHACS-3.74-RHEL-8 | — | 3.74.8-7 | Patch available | CNA |
| Red Hat | RHACS-3.74-RHEL-8 | — | 3.74.8-9 | Patch available | CNA |
| Red Hat | RHACS-3.74-RHEL-8 | — | 3.74.8-9 | Patch available | CNA |
| Red Hat | RHACS-4.1-RHEL-8 | — | 4.1.6-6 | Patch available | CNA |
| Red Hat | RHACS-4.1-RHEL-8 | — | 4.1.6-6 | Patch available | CNA |
| Red Hat | RHACS-4.1-RHEL-8 | — | 4.1.6-6 | Patch available | CNA |
| Red Hat | RHACS-4.1-RHEL-8 | — | 4.1.6-6 | Patch available | CNA |
| Red Hat | RHACS-4.1-RHEL-8 | — | 4.1.6-6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Software Collections | — | — | No fix listed | CNA |
- Red Hat Advanced Cluster Security 4.2 VendorRed Hat Affected — Fixed in 4.2.4-6 Patch available CNA
- Red Hat Advanced Cluster Security 4.2 VendorRed Hat Affected — Fixed in 4.2.4-6 Patch available CNA
- Red Hat Advanced Cluster Security 4.2 VendorRed Hat Affected — Fixed in 4.2.4-7 Patch available CNA
- Red Hat Advanced Cluster Security 4.2 VendorRed Hat Affected — Fixed in 4.2.4-6 Patch available CNA
- Red Hat Advanced Cluster Security 4.2 VendorRed Hat Affected — Fixed in 4.2.4-7 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8090020231114113712.a75119d5 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8090020231128173330.a75119d5 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8090020231114113548.a75119d5 Patch available CNA
- Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 8020020231128165246.4cda2c84 Patch available CNA
- Red Hat Enterprise Linux 8.2 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8020020231128165246.4cda2c84 Patch available CNA
- Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8020020231128165246.4cda2c84 Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8040020231127153301.522a0ee4 Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8040020231127154806.522a0ee4 Patch available CNA
- Red Hat Enterprise Linux 8.4 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8040020231127153301.522a0ee4 Patch available CNA
- Red Hat Enterprise Linux 8.4 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8040020231127154806.522a0ee4 Patch available CNA
- Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8040020231127153301.522a0ee4 Patch available CNA
- Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8040020231127154806.522a0ee4 Patch available CNA
- Red Hat Enterprise Linux 8.6 Extended Update Support VendorRed Hat Affected — Fixed in 8060020231114115246.ad008a3a Patch available CNA
- Red Hat Enterprise Linux 8.6 Extended Update Support VendorRed Hat Affected — Fixed in 8060020231128165328.ad008a3a Patch available CNA
- Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 8080020231114105206.63b34585 Patch available CNA
- Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 8080020231128165335.63b34585 Patch available CNA
- Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 8080020231113134015.63b34585 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 13.13-1.el9_3 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 9030020231120082734.rhel9 Patch available CNA
- Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 13.13-1.el9_0 Patch available CNA
- Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 13.13-1.el9_2 Patch available CNA
- Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 9020020231115020618.rhel9 Patch available CNA
- Red Hat Software Collections for Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 12.17-1.el7 Patch available CNA
- Red Hat Software Collections for Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 13.13-1.el7 Patch available CNA
- RHACS-3.74-RHEL-8 VendorRed Hat Affected — Fixed in 3.74.8-9 Patch available CNA
- RHACS-3.74-RHEL-8 VendorRed Hat Affected — Fixed in 3.74.8-9 Patch available CNA
- RHACS-3.74-RHEL-8 VendorRed Hat Affected — Fixed in 3.74.8-7 Patch available CNA
- RHACS-3.74-RHEL-8 VendorRed Hat Affected — Fixed in 3.74.8-9 Patch available CNA
- RHACS-3.74-RHEL-8 VendorRed Hat Affected — Fixed in 3.74.8-9 Patch available CNA
- RHACS-4.1-RHEL-8 VendorRed Hat Affected — Fixed in 4.1.6-6 Patch available CNA
- RHACS-4.1-RHEL-8 VendorRed Hat Affected — Fixed in 4.1.6-6 Patch available CNA
- RHACS-4.1-RHEL-8 VendorRed Hat Affected — Fixed in 4.1.6-6 Patch available CNA
- RHACS-4.1-RHEL-8 VendorRed Hat Affected — Fixed in 4.1.6-6 Patch available CNA
- RHACS-4.1-RHEL-8 VendorRed Hat Affected — Fixed in 4.1.6-6 Patch available CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* | 11.0 to before 11.21; 12.0 to before 12.16; 13.0 to before 13.12; 14.0 to before 14.9; 15.0 to before 15.4 | Vulnerable | PostgreSQL |
| cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* | 12.0 | Vulnerable | Debian |
- cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions 11.0 to before 11.21; 12.0 to before 12.16; 13.0 to before 13.12; 14.0 to before 14.9; 15.0 to before 15.4 Vulnerable ·PostgreSQL
- cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian
Remediation
Red Hat 21 advisories
- RHSA-2024:0337 Released 2024-01-22 · Red Hat rating ImportantRHACS 4.2 security update
- RHACS 4.2 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-operator-bundle +2
- RHSA-2024:0332 Released 2024-01-22 · Red Hat rating ImportantACS 4.1 enhancement update
- RHACS 4.1 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-operator-bundle +2
- RHSA-2024:0304 Released 2024-01-18 · Red Hat rating ImportantRHACS 3.74 enhancement and security update
- RHACS 3.74 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-operator-bundle +2
Show 18 more Red Hat advisories
- RHSA-2023:7884 Released 2023-12-20 · Red Hat rating Importantpostgresql:15 security update
- Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.s390x::postgresql:15 +47
- RHSA-2023:7883 Released 2023-12-20 · Red Hat rating Importantpostgresql:15 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.s390x::postgresql:15 +47
- RHSA-2023:7885 Released 2023-12-20 · Red Hat rating Importantpostgresql:15 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47
- RHSA-2023:7785 Released 2023-12-13 · Red Hat rating Importantpostgresql:15 security update
- Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47
- RHSA-2023:7784 Released 2023-12-13 · Red Hat rating Importantpostgresql security update
- Red Hat CodeReady Linux Builder (v. 9) postgresql-docs-13.13-1.el9_3, postgresql-private-devel-13.13-1.el9_3, postgresql-server-devel-13.13-1.el9_3 +3
- Red Hat Enterprise Linux AppStream (v. 9) postgresql-13.13-1.el9_3, postgresql-contrib-13.13-1.el9_3, postgresql-plperl-13.13-1.el9_3 +5
- RHSA-2023:7770 Released 2023-12-13 · Red Hat rating Importantrh-postgresql12-postgresql security update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-postgresql12-postgresql-12.17-1.el7, rh-postgresql12-postgresql-contrib-12.17-1.el7, rh-postgresql12-postgresql-contrib-syspaths-12.17-1.el7 +11
- Red Hat Software Collections for RHEL(v. 7) rh-postgresql12-postgresql-12.17-1.el7, rh-postgresql12-postgresql-contrib-12.17-1.el7, rh-postgresql12-postgresql-contrib-syspaths-12.17-1.el7 +11
- RHSA-2023:7772 Released 2023-12-13 · Red Hat rating Importantrh-postgresql13-postgresql security update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-postgresql13-postgresql-13.13-1.el7, rh-postgresql13-postgresql-contrib-13.13-1.el7, rh-postgresql13-postgresql-contrib-syspaths-13.13-1.el7 +12
- Red Hat Software Collections for RHEL(v. 7) rh-postgresql13-postgresql-13.13-1.el7, rh-postgresql13-postgresql-contrib-13.13-1.el7, rh-postgresql13-postgresql-contrib-syspaths-13.13-1.el7 +12
- RHSA-2023:7714 Released 2023-12-11 · Red Hat rating Importantpostgresql:12 security update
- Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.aarch64::postgresql:12, pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.s390x::postgresql:12 +47
- RHSA-2023:7695 Released 2023-12-07 · Red Hat rating Importantpostgresql:13 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
- Red Hat Enterprise Linux AppStream E4S (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.aarch64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.ppc64le::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.s390x::postgresql:13 +47
- Red Hat Enterprise Linux AppStream TUS (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
- RHSA-2023:7694 Released 2023-12-07 · Red Hat rating Importantpostgresql:12 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.src::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.4.0+11288+c193d6d7.src::postgresql:12 +15
- Red Hat Enterprise Linux AppStream E4S (v.8.4) pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.aarch64::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.ppc64le::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.s390x::postgresql:12 +47
- Red Hat Enterprise Linux AppStream TUS (v.8.4) pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.src::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.4.0+11288+c193d6d7.src::postgresql:12 +15
- RHSA-2023:7666 Released 2023-12-06 · Red Hat rating Importantpostgresql:12 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.aarch64::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.s390x::postgresql:12 +47
- RHSA-2023:7667 Released 2023-12-06 · Red Hat rating Importantpostgresql:12 security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.src::postgresql:12, pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.2.0+9043+1dbb5661.src::postgresql:12 +15
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.ppc64le::postgresql:12, pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.src::postgresql:12, pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.x86_64::postgresql:12 +29
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.src::postgresql:12, pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.2.0+9043+1dbb5661.src::postgresql:12 +15
- RHSA-2023:7656 Released 2023-12-05 · Red Hat rating Importantpostgresql:12 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.aarch64::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.s390x::postgresql:12 +47
- RHSA-2023:7616 Released 2023-11-30 · Red Hat rating Importantpostgresql security update
- Red Hat CodeReady Linux Builder EUS (v.9.2) postgresql-docs-13.13-1.el9_2, postgresql-private-devel-13.13-1.el9_2, postgresql-server-devel-13.13-1.el9_2 +3
- Red Hat Enterprise Linux AppStream EUS (v.9.2) postgresql-13.13-1.el9_2, postgresql-contrib-13.13-1.el9_2, postgresql-plperl-13.13-1.el9_2 +5
- RHSA-2023:7581 Released 2023-11-29 · Red Hat rating Importantpostgresql:13 security update
- Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.s390x::postgresql:13 +47
- RHSA-2023:7580 Released 2023-11-29 · Red Hat rating Importantpostgresql:13 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13 +47
- RHSA-2023:7579 Released 2023-11-29 · Red Hat rating Importantpostgresql:13 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13 +47
- RHSA-2023:7545 Released 2023-11-28 · Red Hat rating Importantpostgresql security update
- Red Hat CodeReady Linux Builder EUS (v.9.0) postgresql-private-devel-13.13-1.el9_0, postgresql-server-devel-13.13-1.el9_0, postgresql-test-13.13-1.el9_0
- Red Hat Enterprise Linux AppStream EUS (v.9.0) postgresql-13.13-1.el9_0, postgresql-contrib-13.13-1.el9_0, postgresql-plperl-13.13-1.el9_0 +5
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| RHACS 3.74 for RHEL 8 | Fixed | RHSA-2024:0304 |
| RHACS 4.1 for RHEL 8 | Fixed | RHSA-2024:0332 |
| RHACS 4.2 for RHEL 8 | Fixed | RHSA-2024:0337 |
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | RHSA-2023:7784 |
| Red Hat CodeReady Linux Builder EUS (v.9.0) | Fixed | RHSA-2023:7545 |
| Red Hat CodeReady Linux Builder EUS (v.9.2) | Fixed | RHSA-2023:7616 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:7581, RHSA-2023:7714, RHSA-2023:7884 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:7784, RHSA-2023:7785 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2023:7667 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2023:7694, RHSA-2023:7695 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.2) | Fixed | RHSA-2023:7667 |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Fixed | RHSA-2023:7694, RHSA-2023:7695 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2023:7580, RHSA-2023:7666 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2023:7579, RHSA-2023:7656, RHSA-2023:7883 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2023:7545 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2023:7616, RHSA-2023:7885 |
| Red Hat Enterprise Linux AppStream TUS (v. 8.2) | Fixed | RHSA-2023:7667 |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Fixed | RHSA-2023:7694, RHSA-2023:7695 |
| Red Hat Software Collections for RHEL Workstation(v. 7) | Fixed | RHSA-2023:7770, RHSA-2023:7772 |
| Red Hat Software Collections for RHEL(v. 7) | Fixed | RHSA-2023:7770, RHSA-2023:7772 |
Not affected: 4 products
- RHACS 3.74 for RHEL 8
- RHACS 4.1 for RHEL 8
- RHACS 4.2 for RHEL 8
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-39417
- 2026-10-03 Alias added: GHSA-jx3x-j983-74m3
References
Advisory 24
- RHSA-2023:7545
- RHSA-2023:7579
- RHSA-2023:7580
- RHSA-2023:7581
- RHSA-2023:7616
- RHSA-2023:7656
- RHSA-2023:7666
- RHSA-2023:7667
- RHSA-2023:7694
- RHSA-2023:7695
- RHSA-2023:7714
- RHSA-2023:7770
- RHSA-2023:7772
- RHSA-2023:7784
- RHSA-2023:7785
- RHSA-2023:7883
- RHSA-2023:7884
- RHSA-2023:7885
- RHSA-2024:0304
- RHSA-2024:0332
- RHSA-2024:0337
- https://access.redhat.com/security/cve/CVE-2023-39417
- RHBZ#2228111
- https://www.postgresql.org/support/security/CVE-2023-39417
More Red Hat Enterprise Linux vulnerabilities
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
- TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
Sources
- CVE-2023-39417 · CVE Program
- CVE-2023-39417 · NVD
- FIRST EPSS
- GHSA-jx3x-j983-74m3 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-39417 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences