CVE-2023-39418
Postgresql: merge fails to enforce update or select row security policies
概要
Postgresql: merge fails to enforce update or select row security policies
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.
影響パッケージ
Bitnami
postgresql
[{"type":"SEMVER","events":[{"introduced":"15.0.0"},{"fixed":"15.4.0"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2023-39418 postgresql-15 修正版: 15.5-0+deb12u1
参照URL
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory bugzilla.redhat.com
- advisory postgresql.org
- patch git.postgresql.org
- web security.netapp.com
- web debian.org
- web nvd.nist.gov