CVE-2023-39417: Update to PG 14.9 and 13.12
An extension script is vulnerable if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). No bundled extension is vulnerable. Vulnerable uses do appear in a documentation example and in non-bundled extensions. Hence, the attack prerequisite is an administrator having installed files of a vulnerable, trusted, non-bundled extension. Subject to that prerequisite, this enables an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. PostgreSQL will block this attack in the core server, so there's no need to modify individual extensions.
Supported, Vulnerable Versions: 11 - 15.
Other sources
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
— Launchpad
PostgreSQL could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in the extension script. By sending a specially crafted request using @extowner@, @extschema@, or @extschema:...@ inside a quoting construct, an attacker could exploit this vulnerability to execute arbitrary code as the bootstrap superuser.
— IBM
PostgreSQL has been updated to 14.9 and 13.12 to mitigate CVE-2023-39417.
— GitLab
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-39417.
What is the severity of CVE-2023-39417?
The severity of CVE-2023-39417 is high.
Which software is affected by CVE-2023-39417?
PostgreSQL versions 11.0 to 15.4 are affected by CVE-2023-39417.
How does the SQL Injection vulnerability in PostgreSQL occur?
The SQL Injection vulnerability occurs when PostgreSQL uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ").
Are there any remedies available for CVE-2023-39417?
Yes, there are remedies available for CVE-2023-39417. Please refer to the official sources for more information.