UpHeron
All vulnerabilities

Servers and applications

CVE-2023-39418

A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

Severity
Medium 4.3
Published
11 Aug 2023
Last changed
17 Jun 2026
Added to UpHeron
16 Oct 2026
Fixed in
15.4
Sources
NVD

Affected software

SoftwareAffected versions
PostgreSQLServers and applications · cpe:a:postgresql:postgresql
  • From 15.0 before 15.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-39418
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-39418