Read the docs
TI-2024-02173 Aliases CVE-2024-2338GHSA-vc6j-mx82-hrhh

SQL Injection in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule

Priority LOW 37CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

PostgreSQL Anonymizer v1.2 contains a SQL injection vulnerability that allows a user who owns a table to elevate to superuser when dynamic masking is enabled. PostgreSQL Anonymizer enables users to set security labels on tables to mask specified columns. There is a flaw that allows complex expressions to be provided as a value. This expression is then later used as it to create the masked views leading to SQL Injection. If dynamic masking is enabled, this will lead to privilege escalation to superuser after the label is created. Users that don't own a table, especially masked users cannot exploit this vulnerability. The problem is resolved in v1.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00461 40th percentileScored 2026-11-07
Fix Fixed PostgreSQL Anonymizer (DALIBO): 1.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DALIBOPostgreSQL Anonymizer1 to before 1.3.01.3.0Patch availableCNA
  • PostgreSQL Anonymizer VendorDALIBO Affected 1 to before 1.3.0 Fixed in 1.3.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dalibo:anonymizer:1.2.0:*:*:*:*:postgresql:*:*1.2.0VulnerableDALIBO
  • cpe:2.3:a:dalibo:anonymizer:1.2.0:*:*:*:*:postgresql:*:* Versions 1.2.0 Vulnerable ·DALIBO

Remediation

  • Fix · CNA PostgreSQL Anonymizer (DALIBO) Fixed in 1.3.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    DALIBO PostgreSQL Anonymizer 1.3.0

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-02174 Improper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rulePriority MEDIUM 41
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-2338
  2. 2026-10-03 Alias added: GHSA-vc6j-mx82-hrhh

References

Patch 1

  • TI-2024-02174 Improper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule CVSS 3.1HIGH 8.8
  • TI-2026-08447 PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() function CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences