← CVE Intelligence

CVE-2023-39418

Postgresql: merge fails to enforce update or select row security policies PUBLISHED

Description (CNA)

A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat Enterprise Linux 8unaffected 8090020231114113548.a75119d5 before *
Red Hat / Red Hat Enterprise Linux 8.8 Extended Update Supportunaffected 8080020231113134015.63b34585 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 9030020231120082734.rhel9 before *
Red Hat / Red Hat Enterprise Linux 9.2 Extended Update Supportunaffected 9020020231115020618.rhel9 before *
Red Hat / Red Hat Enterprise Linux 6unaffected
Red Hat / Red Hat Enterprise Linux 7unaffected
Red Hat / Red Hat Enterprise Linux 8unaffected
Red Hat / Red Hat Enterprise Linux 8unaffected
Red Hat / Red Hat Enterprise Linux 8unaffected
Red Hat / Red Hat Enterprise Linux 9unaffected
Red Hat / Red Hat Software Collectionsunaffected
Red Hat / Red Hat Software Collectionsunaffected
Red Hat / Red Hat Software Collectionsunaffected

CWE

CWE-1220

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.