CVE-2023-39418 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	3.1 LOW	NETWORK	HIGH	LOW	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 57%

Affected Products (NVD)

Vendor	Product	Version
postgresql	postgresql	15.0 ≤ 𝑥 < 15.4
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
debian	debian_linux	12.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

postgresql-13

bullseye	13.16-0+deb11u1 fixed
bullseye (security)	13.18-0+deb11u1 fixed

postgresql-15

bookworm	15.8-0+deb12u1 fixed
bookworm (security)	15.10-0+deb12u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

postgresql-10

bionic	not-affected
focal	dne
jammy	dne
lunar	dne
mantic	dne
trusty	dne
xenial	dne

postgresql-12

bionic	dne
focal	not-affected
jammy	dne
lunar	dne
mantic	dne
trusty	ignored
xenial	dne

postgresql-14

bionic	dne
focal	dne
jammy	not-affected
lunar	dne
mantic	dne
trusty	dne
xenial	dne

postgresql-15

bionic	ignored
focal	dne
jammy	dne
lunar	Fixed 15.4-0ubuntu0.23.04.1 released
mantic	Fixed 15.4-1ubuntu1 released
trusty	ignored
xenial	ignored

postgresql-9.1

bionic	dne
focal	dne
jammy	dne
lunar	dne
mantic	dne
trusty	ignored
xenial	dne

postgresql-9.3

bionic	dne
focal	dne
jammy	dne
lunar	dne
mantic	dne
trusty	not-affected
xenial	dne

postgresql-9.5

bionic	dne
focal	dne
jammy	dne
lunar	dne
mantic	dne
trusty	dne
xenial	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

libecpg6

suse enterprise sap 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise server 12 SP3	15.4-3.12.1 fixed
suse enterprise server 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise server 15 SP5	15.4-150200.5.12.1 fixed

libecpg6-32bit

suse enterprise server 12 SP3

15.4-3.12.1

fixed

libpq5

suse enterprise desktop 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise desktop 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise server 12 SP3	15.4-3.12.1 fixed
suse enterprise server 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise server 15 SP5	15.4-150200.5.12.1 fixed

libpq5-32bit

suse enterprise server 12 SP3

15.4-3.12.1

fixed

postgresql15

suse enterprise desktop 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise desktop 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP6	15.6-150600.14.4 fixed
suse enterprise sap 15 SP7	15.12-150600.16.14.1 fixed
suse enterprise server 12 SP3	15.4-3.12.1 fixed
suse enterprise server 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise server 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise server 15 SP6	15.6-150600.14.4 fixed
suse enterprise server 15 SP7	15.12-150600.16.14.1 fixed

postgresql15-contrib

suse enterprise sap 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP6	15.6-150600.14.4 fixed
suse enterprise sap 15 SP7	15.12-150600.16.14.1 fixed
suse enterprise server 12 SP3	15.4-3.12.1 fixed
suse enterprise server 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise server 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise server 15 SP6	15.6-150600.14.4 fixed
suse enterprise server 15 SP7	15.12-150600.16.14.1 fixed

postgresql15-devel

suse enterprise sap 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP7	15.12-150600.16.14.1 fixed
suse enterprise server 12 SP3	15.4-3.12.1 fixed
suse enterprise server 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise server 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise server 15 SP7	15.12-150600.16.14.1 fixed

postgresql15-docs

suse enterprise sap 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise server 12 SP3	15.4-3.12.1 fixed
suse enterprise server 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise server 15 SP5	15.4-150200.5.12.1 fixed

postgresql15-plperl

suse enterprise sap 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise server 12 SP3	15.4-3.12.1 fixed
suse enterprise server 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise server 15 SP5	15.4-150200.5.12.1 fixed

postgresql15-plpython

suse enterprise sap 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise server 12 SP3	15.4-3.12.1 fixed
suse enterprise server 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise server 15 SP5	15.4-150200.5.12.1 fixed

postgresql15-pltcl

suse enterprise sap 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise server 12 SP3	15.4-3.12.1 fixed
suse enterprise server 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise server 15 SP5	15.4-150200.5.12.1 fixed

postgresql15-server

suse enterprise sap 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP6	15.6-150600.14.4 fixed
suse enterprise sap 15 SP7	15.12-150600.16.14.1 fixed
suse enterprise server 12 SP3	15.4-3.12.1 fixed
suse enterprise server 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise server 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise server 15 SP6	15.6-150600.14.4 fixed
suse enterprise server 15 SP7	15.12-150600.16.14.1 fixed

postgresql15-server-devel

suse enterprise sap 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise sap 15 SP5	15.4-150200.5.12.1 fixed
suse enterprise server 12 SP3	15.4-3.12.1 fixed
suse enterprise server 15 SP4	15.4-150200.5.12.1 fixed
suse enterprise server 15 SP5	15.4-150200.5.12.1 fixed

Amazon Linux Releases

Amazon Package

Release

postgresql15

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-contrib

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-contrib-debuginfo

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-debuginfo

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-debugsource

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-docs

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-docs-debuginfo

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-llvmjit

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-llvmjit-debuginfo

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-plperl

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-plperl-debuginfo

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-plpython3

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-plpython3-debuginfo

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-pltcl

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-pltcl-debuginfo

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-private-devel

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-private-libs

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-private-libs-debuginfo

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-server

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-server-debuginfo

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-server-devel

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-server-devel-debuginfo

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-static

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-test

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-test-debuginfo

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-test-rpm-macros

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-upgrade

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-upgrade-debuginfo

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-upgrade-devel

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

postgresql15-upgrade-devel-debuginfo

Amazon Linux 2023

0:15.4-1.amzn2023.0.1

fixed

Common Weakness Enumeration

CWE-1220 - Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

References

https://access.redhat.com/errata/RHSA-2023:7785

https://access.redhat.com/errata/RHSA-2023:7883

https://access.redhat.com/errata/RHSA-2023:7884

https://access.redhat.com/errata/RHSA-2023:7885

https://access.redhat.com/security/cve/CVE-2023-39418

https://bugzilla.redhat.com/show_bug.cgi?id=2228112

https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229

https://www.postgresql.org/support/security/CVE-2023-39418/

https://access.redhat.com/errata/RHSA-2023:7785

https://access.redhat.com/errata/RHSA-2023:7883

https://access.redhat.com/errata/RHSA-2023:7884

https://access.redhat.com/errata/RHSA-2023:7885

https://access.redhat.com/security/cve/CVE-2023-39418

https://bugzilla.redhat.com/show_bug.cgi?id=2228112

https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229

https://security.netapp.com/advisory/ntap-20230915-0002/

https://www.debian.org/security/2023/dsa-5553

https://www.postgresql.org/support/security/CVE-2023-39418/