Description
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Software Collections | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | postgresql-15 | 15.5-0+deb12u1 | DSA-5553-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | pg_repack | 1.4.8-1.module+el9.2.0+17405+aeb9ec60 | RHSA-2023:7785 |
| RHEL 9 | pgaudit | 1.7.0-1.module+el9.2.0+17405+aeb9ec60 | RHSA-2023:7785 |
| RHEL 9 | postgres-decoderbufs | 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 | RHSA-2023:7785 |
| RHEL 9 | postgresql +14 | 15.5-1.module+el9.2.0.z+20667+a2d2a8a9 | RHSA-2023:7785 |
| RHEL 8 | pg_repack | 1.4.8-1.module+el8.9.0+19797+c4ce5969 | RHSA-2023:7884 |
| RHEL 8 | pgaudit | 1.7.0-1.module+el8.9.0+19797+c4ce5969 | RHSA-2023:7884 |
| RHEL 8 | postgres-decoderbufs | 1.9.7-1.Final.module+el8.9.0+19797+c4ce5969 | RHSA-2023:7884 |
| RHEL 8 | postgresql +14 | 15.5-1.module+el8.9.0+20663+03952ce4 | RHSA-2023:7884 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | pg_repack | 1.4.8-1.module+el9.2.0+17405+aeb9ec60 | RHSA-2023:7885 |
| RHEL 9.2 EUS | pgaudit | 1.7.0-1.module+el9.2.0+17405+aeb9ec60 | RHSA-2023:7885 |
| RHEL 9.2 EUS | postgres-decoderbufs | 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 | RHSA-2023:7885 |
| RHEL 9.2 EUS | postgresql +14 | 15.5-1.module+el9.2.0.z+20667+a2d2a8a9 | RHSA-2023:7885 |
| RHEL 8.8 EUS | pg_repack | 1.4.8-1.module+el8.8.0+17071+aaaceaa4 | RHSA-2023:7883 |
| RHEL 8.8 EUS | pgaudit | 1.7.0-1.module+el8.8.0+17071+aaaceaa4 | RHSA-2023:7883 |
| RHEL 8.8 EUS | postgres-decoderbufs | 1.9.7-1.Final.module+el8.8.0+17071+aaaceaa4 | RHSA-2023:7883 |
| RHEL 8.8 EUS | postgresql +14 | 15.5-1.module+el8.8.0+20658+5fb3eedd | RHSA-2023:7883 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | pg_repack | 1.4.8-1.module_el9.2.0+22+09653793 | ALSA-2023:7785 |
| AlmaLinux 9 | pgaudit | 1.7.0-1.module_el9.2.0+22+09653793 | ALSA-2023:7785 |
| AlmaLinux 9 | postgres-decoderbufs | 1.9.7-1.Final.module_el9.2.0+22+09653793 | ALSA-2023:7785 |
| AlmaLinux 9 | postgresql +14 | 15.5-1.module_el9.3.0+52+21733919 | ALSA-2023:7785 |
| AlmaLinux 8 | pg_repack | 1.4.8-1.module_el8.8.0+3487+43ec1b9f | ALSA-2023:7884 |
| AlmaLinux 8 | pgaudit | 1.7.0-1.module_el8.8.0+3487+43ec1b9f | ALSA-2023:7884 |
| AlmaLinux 8 | postgres-decoderbufs | 1.9.7-1.Final.module_el8.8.0+3487+43ec1b9f | ALSA-2023:7884 |
| AlmaLinux 8 | postgresql +14 | 15.5-1.module_el8.9.0+3706+885c732e | ALSA-2023:7884 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | pgaudit | 1.7.0-1.module+el9.5.0+30637+4391fcca | RLSA-2023:7785 |
| Rocky Linux 9 | postgres-decoderbufs | 1.9.7-1.Final.module+el9.5.0+30637+4391fcca | RLSA-2023:7785 |
| Rocky Linux 8 | pg_repack | 1.4.8-1.module+el8.9.0+1525+fc91df60 | RLSA-2023:7884 |
| Rocky Linux 8 | pgaudit | 1.7.0-1.module+el8.9.0+1525+fc91df60 | RLSA-2023:7884 |
| Rocky Linux 8 | postgres-decoderbufs | 1.9.7-1.Final.module+el8.9.0+1525+fc91df60 | RLSA-2023:7884 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | postgresql15 | 15.4-150200.5.12.1 | SUSE-SU-2023:3347-1 |
| SLES 15 SP4 | postgresql15 | 15.4-150200.5.12.1 | SUSE-SU-2023:3347-1 |
| SLES 12 SP5 | postgresql15 | 15.4-3.12.1 | SUSE-SU-2023:3342-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | postgresql15 | 15.4-3.12.1 | SUSE-SU-2023:3342-1 |
| SUSE Manager Server 4.2 | postgresql15 | 15.4-150200.5.12.1 | SUSE-SU-2023:3347-1 |
| SUSE Manager Proxy 4.2 | postgresql15 | 15.4-150200.5.12.1 | SUSE-SU-2023:3347-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | postgresql15 | 15.4-1.1 | openSUSE-SU-2024:13134-1 |
| openSUSE Leap 15.5 | postgresql15 | 15.4-150200.5.12.1 | SUSE-SU-2023:3347-1 |
| openSUSE Leap 15.4 | postgresql15 | 15.4-150200.5.12.1 | SUSE-SU-2023:3347-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.22 | postgresql15 | 15.4-r0 | — |
| Alpine v3.21 | postgresql15 | 15.4-r0 | — |
| Alpine v3.20 | postgresql14 | 14.9-r0 | — |
| Alpine v3.20 | postgresql15 | 15.4-r0 | — |
| Alpine v3.19 | postgresql13 | 13.12-r0 | — |
| Alpine v3.19 | postgresql14 | 14.9-r0 | — |
| Alpine v3.19 | postgresql15 | 15.4-r0 | — |
| Alpine v3.18 | postgresql12 | 12.16-r0 | — |
| Alpine v3.18 | postgresql13 | 13.12-r0 | — |
| Alpine v3.18 | postgresql14 | 14.9-r0 | — |
| Alpine v3.18 | postgresql15 | 15.4-r0 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.17 | postgresql12 | 12.16-r0 | — |
| Alpine v3.17 | postgresql13 | 13.12-r0 | — |
| Alpine v3.17 | postgresql14 | 14.9-r0 | — |
| Alpine v3.17 | postgresql15 | 15.4-r0 | — |
| Alpine v3.16 | postgresql12 | 12.16-r0 | — |
| Alpine v3.16 | postgresql13 | 13.12-r0 | — |
| Alpine v3.16 | postgresql14 | 14.9-r0 | — |
| Alpine v3.15 | postgresql12 | 12.16-r0 | — |
| Alpine v3.15 | postgresql13 | 13.12-r0 | — |
| Alpine v3.15 | postgresql14 | 14.9-r0 | — |
| Alpine v3.14 | postgresql | 13.12-r0 | — |
| Alpine v3.13 | postgresql | 13.12-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | postgresql15 +15 | 15.4-1.amzn2023.0.1 | ALAS2023-2023-387 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | pg_repack | 1.4.8-1.module+el9.2.0+21134+ceb95ed9 | ELSA-2023-7785 |
| Oracle Linux 9 | pgaudit | 1.7.0-1.module+el9.2.0+21134+ceb95ed9 | ELSA-2023-7785 |
| Oracle Linux 9 | postgres-decoderbufs | 1.9.7-1.Final.module+el9.2.0+21134+ceb95ed9 | ELSA-2023-7785 |
| Oracle Linux 9 | postgresql +14 | 15.5-1.module+el9.3.0+90103+1d024772 | ELSA-2023-7785 |
| Oracle Linux 8 | pg_repack | 1.4.8-1.module+el8.9.0+90110+d8a562d5 | ELSA-2023-7884 |
| Oracle Linux 8 | pgaudit | 1.7.0-1.module+el8.9.0+90110+d8a562d5 | ELSA-2023-7884 |
| Oracle Linux 8 | postgres-decoderbufs | 1.9.7-1.Final.module+el8.9.0+90110+d8a562d5 | ELSA-2023-7884 |
| Oracle Linux 8 | postgresql +14 | 15.5-1.module+el8.9.0+90110+d8a562d5 | ELSA-2023-7884 |
Advisories 18
- ALSA-2023:7785 Important: postgresql:15 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:7884 Important: postgresql:15 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2023:7885 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Oct 1, 2026
- RHSA-2023:7884 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Oct 1, 2026
- RHSA-2023:7883 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Oct 1, 2026
- RHSA-2023:7785 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Oct 1, 2026
- WID-SEC-2023-2038 PostgreSQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 30, 2026
- DSA-5553-1 postgresql-15 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2023:3347-1 Security update for postgresql15 SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2023:7884 Important: postgresql:15 security update Rocky Linux Security Advisories · Feb 3, 2026
- RLSA-2023:7785 Important: postgresql:15 security update Rocky Linux Security Advisories · Oct 9, 2025
- openSUSE-SU-2024:13134-1 libecpg6-15.4-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2023:3342-1 Security update for postgresql15 SUSE / openSUSE Security Updates · May 2, 2025
- ICSA-24-046-15 Siemens SINEC NMS CISA ICS & IT advisories · Mar 12, 2024
- SSA-943925 SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 Siemens ProductCERT · Mar 12, 2024
- ALAS2023-2023-387 Moderate: postgresql15 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 29, 2024
- ELSA-2023-7884 Important: postgresql:15 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Dec 20, 2023
- ELSA-2023-7785 Important: postgresql:15 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Dec 13, 2023
References
- RHSA-2023:7785 vendor-advisory
- RHSA-2023:7883 vendor-advisory
- RHSA-2023:7884 vendor-advisory
- RHSA-2023:7885 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-39418 vdb-entry
- RHBZ#2228112 issue-tracking
- https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229
- https://www.postgresql.org/support/security/CVE-2023-39418/