Nixpkgs Security Tracker

Login with GitHub

Suggestion detail

Untriaged
(browse all)
Permalink CVE-2023-39417
created 4 months, 3 weeks ago
Postgresql: extension script @substitutions@ within quoting allow sql injection

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

Affected products

postgresql
  • ==11.21
  • ==13.12
  • ==15.4
  • ==12.16
  • ==14.9
  • *
postgresql:12
  • *
postgresql:13
  • *
postgresql:15
  • *
postgresql:10/postgresql
postgresql:15/postgresql
  • *
rh-postgresql10-postgresql
rh-postgresql12-postgresql
  • *
rh-postgresql13-postgresql
  • *
advanced-cluster-security/rhacs-main-rhel8
  • *
advanced-cluster-security/rhacs-operator-bundle
  • *
advanced-cluster-security/rhacs-central-db-rhel8
  • *
advanced-cluster-security/rhacs-scanner-db-rhel8
  • *
advanced-cluster-security/rhacs-scanner-db-slim-rhel8
  • *

Matching in nixpkgs

pkgs.postgresql

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_13

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_14

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_15

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_16

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_17

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_18

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_jdbc

JDBC driver for PostgreSQL allowing Java programs to connect to a PostgreSQL database

  • nixos-unstable -

pkgs.postgresqlPackages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

pkgs.postgresql13Packages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

pkgs.postgresql14Packages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

pkgs.postgresql15Packages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

pkgs.postgresql16Packages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

pkgs.postgresql18Packages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

Package maintainers