NetSight
IP …
high7.5

CVE-2023-39417

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construc…

Impact

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

Affected products

VendorProductAffected versions
PostgresqlPostgresql
from 11.0 before 11.21
from 12.0 before 12.16
from 13.0 before 13.12
from 14.0 before 14.9
from 15.0 before 15.4
RedhatSoftware Collections
All versions
RedhatEnterprise Linux
Versions 8.0, 9.0
DebianDebian Linux
Versions 8.0, 11.0, 12.0
Red HatRed Hat Enterprise Linux 9
Versions patch: 9030020231120082734.rhel9, patch: 0:13.13-1.el9_3
Red HatRed Hat Software Collections For Red Hat Enterprise Linux 7
Versions patch: 0:13.13-1.el7, patch: 0:12.17-1.el7
Red HatRed Hat Enterprise Linux 8.4 Update Services For SAP Solutions
Versions patch: 8040020231127153301.522a0ee4, patch: 8040020231127154806.522a0ee4
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support
Versions patch: 8080020231113134015.63b34585, patch: 8080020231114105206.63b34585, patch: 8080020231128165335.63b34585
Red HatRed Hat Enterprise Linux 8
Versions patch: 8090020231128173330.a75119d5, patch: 8090020231114113548.a75119d5, patch: 8090020231114113712.a75119d5
Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Service
Versions patch: 8040020231127154806.522a0ee4, patch: 8040020231127153301.522a0ee4
Red HatRed Hat Enterprise Linux 8.2 Update Services For SAP Solutions
Version patch: 8020020231128165246.4cda2c84
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Versions patch: 8040020231127153301.522a0ee4, patch: 8040020231127154806.522a0ee4
Red HatRHACS-4.1-RHEL-8
Version patch: 4.1.6-6
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support
Versions patch: 8060020231114115246.ad008a3a, patch: 8060020231128165328.ad008a3a
Red HatRHACS-3.74-RHEL-8
Versions patch: 3.74.8-9, patch: 3.74.8-7
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support
Versions patch: 9020020231115020618.rhel9, patch: 0:13.13-1.el9_2

Weakness classification

CWE-89

References