MediumFix available
postgresql, postgresql13 and 2 more products — security advisory
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.
- Products
- postgresql, postgresql13, postgresql14, postgresql15
- Affected versions
- Not specified
- Fixed versions
- 13.12-r0, 14.9-r0, 15.4-r0
- CVEs
- CVE-2023-39418
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 14:59 UTC · Revision 1
Source evidence
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.
osv:ALPINE-CVE-2023-39418
postgresql
Fixed versions: 13.12-r0
postgresql
Fixed versions: 13.12-r0
postgresql13
Fixed versions: 13.12-r0
postgresql13
Fixed versions: 13.12-r0
postgresql14
Fixed versions: 14.9-r0
postgresql14
Fixed versions: 14.9-r0
postgresql14
Fixed versions: 14.9-r0
postgresql14
Fixed versions: 14.9-r0
postgresql15
Fixed versions: 15.4-r0
postgresql15
Fixed versions: 15.4-r0
postgresql15
Fixed versions: 15.4-r0
postgresql15
Fixed versions: 15.4-r0
Complete source record
{
"id": "2e0b9616caff4698886677770e52f6e829d8acc1917541d07c7ca034a7b3b6d4",
"url": "https://osv.dev/vulnerability/ALPINE-CVE-2023-39418",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALPINE-CVE-2023-39418",
"summary": "A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.",
"evidence": "osv:ALPINE-CVE-2023-39418",
"products": [
{
"name": {
"value": "postgresql",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.12-r0",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.12-r0",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql13",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.12-r0",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql13",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.12-r0",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql14",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "14.9-r0",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql14",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "14.9-r0",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql14",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "14.9-r0",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql14",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "14.9-r0",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql15",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "15.4-r0",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql15",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "15.4-r0",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql15",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "15.4-r0",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql15",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "15.4-r0",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "ALPINE-CVE-2023-39418",
"aliases": [
"ALPINE-CVE-2023-39418"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "15.0"
},
{
"fixed": "13.12-r0"
}
]
}
],
"package": {
"name": "postgresql",
"purl": "pkg:apk/alpine/postgresql?arch=source",
"ecosystem": "Alpine:v3.13"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-39418.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "15.0"
},
{
"fixed": "13.12-r0"
}
]
}
],
"package": {
"name": "postgresql",
"purl": "pkg:apk/alpine/postgresql?arch=source",
"ecosystem": "Alpine:v3.14"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-39418.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.12-r0"
}
]
}
],
"package": {
"name": "postgresql13",
"purl": "pkg:apk/alpine/postgresql13?arch=source",
"ecosystem": "Alpine:v3.15"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-39418.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.12-r0"
}
]
}
],
"package": {
"name": "postgresql13",
"purl": "pkg:apk/alpine/postgresql13?arch=source",
"ecosystem": "Alpine:v3.16"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-39418.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.9-r0"
}
]
}
],
"package": {
"name": "postgresql14",
"purl": "pkg:apk/alpine/postgresql14?arch=source",
"ecosystem": "Alpine:v3.15"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-39418.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.9-r0"
}
]
}
],
"package": {
"name": "postgresql14",
"purl": "pkg:apk/alpine/postgresql14?arch=source",
"ecosystem": "Alpine:v3.16"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-39418.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.9-r0"
}
]
}
],
"package": {
"name": "postgresql14",
"purl": "pkg:apk/alpine/postgresql14?arch=source",
"ecosystem": "Alpine:v3.17"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-39418.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.9-r0"
}
]
}
],
"package": {
"name": "postgresql14",
"purl": "pkg:apk/alpine/postgresql14?arch=source",
"ecosystem": "Alpine:v3.18"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-39418.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "15.4-r0"
}
]
}
],
"package": {
"name": "postgresql15",
"purl": "pkg:apk/alpine/postgresql15?arch=source",
"ecosystem": "Alpine:v3.17"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-39418.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "15.4-r0"
}
]
}
],
"package": {
"name": "postgresql15",
"purl": "pkg:apk/alpine/postgresql15?arch=source",
"ecosystem": "Alpine:v3.18"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-39418.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "15.4-r0"
}
]
}
],
"package": {
"name": "postgresql15",
"purl": "pkg:apk/alpine/postgresql15?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-39418.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "15.4-r0"
}
]
}
],
"package": {
"name": "postgresql15",
"purl": "pkg:apk/alpine/postgresql15?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-39418.json"
},
"ecosystem_specific": {}
}
],
"modified": "2026-10-26T17:17:58.637398979Z",
"provider": "osv",
"upstream": [
"CVE-2023-39418"
],
"references": [
"https://security.alpinelinux.org/vuln/CVE-2023-39418"
]
},
"related_cves": [
{
"value": "CVE-2023-39418",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 454478,
"published_at": "2023-08-11T13:15:09.963+00:00"
}