Vulnerability in PostgreSQL with MERGE Command
Summary
CVE-2023-39418: A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. Affects postgresql across 2 version ranges.
>= 2a7ce2e2ce474504a707ec03e128fde66cfb8b48, < 83ed1f71c88ae948a5b6ec6d2a4802cc54470102
< 13.12-r0
Fixed in 13.12-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an open-source relational database management system known for its robustness and extensibility. It provides various features and functionalities for storing and manipulating data. However, a vulnerability has been discovered in PostgreSQL related to the use of the MERGE command.
Vulnerability Detail
The vulnerability (CVE-2023-39418) arises from the failure of the MERGE command to test new rows against row security policies defined for UPDATE and SELECT operations. This means that if UPDATE and SELECT policies forbid certain rows that INSERT policies do not forbid, a user could store such rows in the database. This vulnerability can potentially lead to unauthorized access and data leakage.
How To Fix
Minimum fixed version
13.12-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can modify their row security policies to explicitly forbid the insertion of rows that should be forbidden by the UPDATE and SELECT policies. By aligning the policies, the vulnerability can be mitigated until the package update is applied. Here is an example of how to modify the policies:
- Identify the row security policies in your PostgreSQL installation.
- Update the policies to include the necessary restrictions for INSERT operations.
- Test the modified policies to ensure they effectively prevent the insertion of forbidden rows.
Please note that this workaround is not a permanent solution and should be followed by updating the PostgreSQL package as soon as possible.
Conclusion
The vulnerability in PostgreSQL with the MERGE command can lead to unauthorized data storage and potential data leakage. It is crucial to update the PostgreSQL package to version 13.12-r0 or later to mitigate this vulnerability. Additionally, modifying the row security policies can serve as a temporary workaround until the update is applied. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql →
FAQ
The vulnerability allows users to store rows that should be forbidden by the row security policies. This can lead to unauthorized access and potential data leakage.
The vulnerability affects PostgreSQL versions 0 to 13.12-r0 in Alpine:v3.13, Alpine:v3.14, Alpine:v3.15, Alpine:v3.16, Alpine:v3.17, and Alpine:v3.18. It is recommended to update to version 13.12-r0 or later.
At the time of this report, there are no known exploits for this vulnerability. However, it is crucial to apply the necessary updates and security patches to mitigate the risk.
No, this vulnerability requires a user with INSERT privileges to exploit it. Remote exploitation is not possible.
Yes, the CVSS score for this vulnerability is 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
