Skip to content
fr Sign in
7.5 High

CVE-2023-39417 IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or…

Description

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

Affected products and versions

Product Affected versions Fixed in
Red Hat Advanced Cluster Security 4.2 4.2 earliest → < 4.2.4-7 4.2.4-7
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 8.2 Advanced Update Support 8020020231128165246.4 earliest → < 8020020231128165246.4cda2c84 8020020231128165246.4cda2c84
Red Hat Enterprise Linux 8.2 Telecommunications Update Service 8020020231128165246.4 earliest → < 8020020231128165246.4cda2c84 8020020231128165246.4cda2c84
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions 8020020231128165246.4 earliest → < 8020020231128165246.4cda2c84 8020020231128165246.4cda2c84
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020231127154806.522 earliest → < 8040020231127154806.522a0ee4 8040020231127154806.522a0ee4
Red Hat Enterprise Linux 8.4 Telecommunications Update Service 8040020231127154806.522 earliest → < 8040020231127154806.522a0ee4 8040020231127154806.522a0ee4
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions 8040020231127154806.522 earliest → < 8040020231127154806.522a0ee4 8040020231127154806.522a0ee4
Red Hat Enterprise Linux 8.6 Extended Update Support 8060020231128165328 earliest → < 8060020231128165328.ad008a3a 8060020231128165328.ad008a3a
Show the 10 other branches
Product Affected versions Fixed in
Red Hat Enterprise Linux 8.8 Extended Update Support 8080020231113134015.63 earliest → < 8080020231113134015.63b34585 8080020231113134015.63b34585
Red Hat Enterprise Linux 9 9030020231120082734 earliest → < 9030020231120082734.rhel9 9030020231120082734.rhel9
Red Hat Enterprise Linux 9.0 Extended Update Support Versions not published
Red Hat Enterprise Linux 9.2 Extended Update Support 9020020231115020618 earliest → < 9020020231115020618.rhel9 9020020231115020618.rhel9
Red Hat Software Collections for Red Hat Enterprise Linux 7 Versions not published
RHACS-3.74-RHEL-8 3.74 earliest → < 3.74.8-9 3.74.8-9
RHACS-4.1-RHEL-8 4.1 earliest → < 4.1.6-6 4.1.6-6
Red Hat Enterprise Linux 6 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Software Collections Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Advanced Cluster Security 4.2

The 5 CVEs of Red Hat Advanced Cluster Security 4.2 →
CVE-2023-4958 In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing,… 6.1 Medium CVE-2023-5870 A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the… 2.2 Low CVE-2023-5869 Postgresql: buffer overrun from integer overflow in array modification 8.8 High CVE-2023-5868 Postgresql: memory disclosure in aggregate function calls 4.3 Medium
Track this CVE