Postgresql: extension script @substitutions@ within quoting allow sql injection
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
Evidence and details
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2023-39417
Red Hat Advanced Cluster Security 4.2
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Advanced Cluster Security 4.2
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Advanced Cluster Security 4.2
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Advanced Cluster Security 4.2
Source reference: /containers/cna/affected/3/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Advanced Cluster Security 4.2
Source reference: /containers/cna/affected/4/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8
Source reference: /containers/cna/affected/5/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8
Source reference: /containers/cna/affected/6/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8
Source reference: /containers/cna/affected/7/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8.2 Advanced Update Support
Source reference: /containers/cna/affected/8/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8.2 Telecommunications Update Service
Source reference: /containers/cna/affected/9/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
Source reference: /containers/cna/affected/10/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Source reference: /containers/cna/affected/11/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Source reference: /containers/cna/affected/12/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8.4 Telecommunications Update Service
Source reference: /containers/cna/affected/13/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8.4 Telecommunications Update Service
Source reference: /containers/cna/affected/14/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
Source reference: /containers/cna/affected/15/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
Source reference: /containers/cna/affected/16/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8.6 Extended Update Support
Source reference: /containers/cna/affected/17/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8.6 Extended Update Support
Source reference: /containers/cna/affected/18/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8.8 Extended Update Support
Source reference: /containers/cna/affected/19/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8.8 Extended Update Support
Source reference: /containers/cna/affected/20/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8.8 Extended Update Support
Source reference: /containers/cna/affected/21/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 9
Source reference: /containers/cna/affected/22/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 9
Source reference: /containers/cna/affected/23/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 9.0 Extended Update Support
Source reference: /containers/cna/affected/24/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 9.2 Extended Update Support
Source reference: /containers/cna/affected/25/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 9.2 Extended Update Support
Source reference: /containers/cna/affected/26/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Software Collections for Red Hat Enterprise Linux 7
Source reference: /containers/cna/affected/27/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Software Collections for Red Hat Enterprise Linux 7
Source reference: /containers/cna/affected/28/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
RHACS-3.74-RHEL-8
Source reference: /containers/cna/affected/29/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
RHACS-3.74-RHEL-8
Source reference: /containers/cna/affected/30/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
RHACS-3.74-RHEL-8
Source reference: /containers/cna/affected/31/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
RHACS-3.74-RHEL-8
Source reference: /containers/cna/affected/32/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
RHACS-3.74-RHEL-8
Source reference: /containers/cna/affected/33/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
RHACS-4.1-RHEL-8
Source reference: /containers/cna/affected/34/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
RHACS-4.1-RHEL-8
Source reference: /containers/cna/affected/35/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
RHACS-4.1-RHEL-8
Source reference: /containers/cna/affected/36/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
RHACS-4.1-RHEL-8
Source reference: /containers/cna/affected/37/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
RHACS-4.1-RHEL-8
Source reference: /containers/cna/affected/38/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 6
Source reference: /containers/cna/affected/39/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 7
Source reference: /containers/cna/affected/40/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Enterprise Linux 8
Source reference: /containers/cna/affected/41/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat Software Collections
Source reference: /containers/cna/affected/42/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
- Related CVEs
- CVE-2023-39417
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics