CVE-2023-39417

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-39417
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:7545 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7579 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7580 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7581 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7616 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7656 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7666 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7667 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7694 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7695 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7714 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7770 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7772 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7784 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7785 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7883 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7884 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7885 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0304 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0332 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0337 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-39417 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2228111 Issue Tracking Third Party Advisory
https://www.postgresql.org/support/security/CVE-2023-39417 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
History

09 Sep 2024, 08:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2023/10/msg00003.html', 'tags': ['Mailing List'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://security.netapp.com/advisory/ntap-20230915-0002/', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://www.debian.org/security/2023/dsa-5553', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://www.debian.org/security/2023/dsa-5554', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}

16 Feb 2024, 15:20

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2023:7770 - () https://access.redhat.com/errata/RHSA-2023:7770 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7884 - () https://access.redhat.com/errata/RHSA-2023:7884 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7579 - () https://access.redhat.com/errata/RHSA-2023:7579 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7667 - () https://access.redhat.com/errata/RHSA-2023:7667 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7694 - () https://access.redhat.com/errata/RHSA-2023:7694 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7883 - () https://access.redhat.com/errata/RHSA-2023:7883 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7772 - () https://access.redhat.com/errata/RHSA-2023:7772 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7616 - () https://access.redhat.com/errata/RHSA-2023:7616 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7784 - () https://access.redhat.com/errata/RHSA-2023:7784 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7666 - () https://access.redhat.com/errata/RHSA-2023:7666 - Third Party Advisory
References () https://www.debian.org/security/2023/dsa-5553 - () https://www.debian.org/security/2023/dsa-5553 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7656 - () https://access.redhat.com/errata/RHSA-2023:7656 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7545 - () https://access.redhat.com/errata/RHSA-2023:7545 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7695 - () https://access.redhat.com/errata/RHSA-2023:7695 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7580 - () https://access.redhat.com/errata/RHSA-2023:7580 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7885 - () https://access.redhat.com/errata/RHSA-2023:7885 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:0332 - () https://access.redhat.com/errata/RHSA-2024:0332 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7581 - () https://access.redhat.com/errata/RHSA-2023:7581 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:0337 - () https://access.redhat.com/errata/RHSA-2024:0337 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7785 - () https://access.redhat.com/errata/RHSA-2023:7785 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:0304 - () https://access.redhat.com/errata/RHSA-2024:0304 - Third Party Advisory
References () https://www.debian.org/security/2023/dsa-5554 - () https://www.debian.org/security/2023/dsa-5554 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7714 - () https://access.redhat.com/errata/RHSA-2023:7714 - Third Party Advisory
CPE cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

25 Jan 2024, 09:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:0337 -

22 Jan 2024, 21:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:0332 -

19 Jan 2024, 03:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:0304 -

20 Dec 2023, 15:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7883 -
  • () https://access.redhat.com/errata/RHSA-2023:7885 -
  • () https://access.redhat.com/errata/RHSA-2023:7884 -

13 Dec 2023, 22:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7784 -
  • () https://access.redhat.com/errata/RHSA-2023:7772 -
  • () https://access.redhat.com/errata/RHSA-2023:7770 -
  • () https://access.redhat.com/errata/RHSA-2023:7785 -
  • () https://access.redhat.com/errata/RHSA-2023:7714 -

07 Dec 2023, 10:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7695 -
  • () https://access.redhat.com/errata/RHSA-2023:7694 -

06 Dec 2023, 16:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7666 -
  • () https://access.redhat.com/errata/RHSA-2023:7667 -

05 Dec 2023, 22:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7656 -

30 Nov 2023, 18:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7616 -

29 Nov 2023, 18:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7579 -
  • () https://access.redhat.com/errata/RHSA-2023:7581 -
  • () https://access.redhat.com/errata/RHSA-2023:7580 -

28 Nov 2023, 18:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7545 -

14 Nov 2023, 14:15

Type Values Removed Values Added
References
  • () https://www.debian.org/security/2023/dsa-5554 -
  • () https://www.debian.org/security/2023/dsa-5553 -

19 Oct 2023, 20:27

Type Values Removed Values Added
References (MISC) https://lists.debian.org/debian-lts-announce/2023/10/msg00003.html - (MISC) https://lists.debian.org/debian-lts-announce/2023/10/msg00003.html - Mailing List
References (MISC) https://security.netapp.com/advisory/ntap-20230915-0002/ - (MISC) https://security.netapp.com/advisory/ntap-20230915-0002/ - Third Party Advisory
CPE cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
First Time Debian debian Linux
Debian

04 Oct 2023, 00:15

Type Values Removed Values Added
References
  • (MISC) https://lists.debian.org/debian-lts-announce/2023/10/msg00003.html -

15 Sep 2023, 14:15

Type Values Removed Values Added
References
  • (MISC) https://security.netapp.com/advisory/ntap-20230915-0002/ -

18 Aug 2023, 17:58

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
First Time Redhat software Collections
Postgresql
Redhat
Redhat enterprise Linux
Postgresql postgresql
CWE CWE-89
CPE cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
References (MISC) https://access.redhat.com/security/cve/CVE-2023-39417 - (MISC) https://access.redhat.com/security/cve/CVE-2023-39417 - Third Party Advisory
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2228111 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2228111 - Issue Tracking, Third Party Advisory
References (MISC) https://www.postgresql.org/support/security/CVE-2023-39417 - (MISC) https://www.postgresql.org/support/security/CVE-2023-39417 - Vendor Advisory

11 Aug 2023, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-08-11 13:15

Updated : 2024-09-09 08:15

NVD link : CVE-2023-39417

Mitre link : CVE-2023-39417

CVE.ORG link : CVE-2023-39417

JSON object : View

Products Affected

debian

  • debian_linux

redhat

  • enterprise_linux
  • software_collections

postgresql

  • postgresql
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')


NetmanageIT Website NetmanageIT OSINT Web NetmanageIT OpenCTI NetmanageIT PDF Tools NetmanageIT CTO Corner Blog NetmanageIT Email Header Analyzer NetmanageIT Password Pusher NetmanageIT Internet Health and Latency Dashboard NetmanageIT Dedicated Speed Test Site NetmanageIT Ubuntu Mirror 10Gbps Copyright OpenCVE 2024