CVE-2023-39417
highIN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construc…
Vendor / product: Postgresql — postgresql
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
CVSS
8.8
8.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2023-08-11 13:15
Modified: 2026-11-01 04:18
NVD status: Modified
Last synced 17 hours ago
Verified against the source API 2026-11-01 04:33 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
postgresql / postgresql ≥11.0 <11.21, ≥12.0 <12.16, ≥13.0 <13.12, ≥14.0 <14.9, ≥15.0 <15.4
redhat / software_collections all versions
redhat / enterprise_linux 8.0, 9.0
debian / debian_linux 8.0, 11.0, 12.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://www.postgresql.org/support/security/CVE-2023-39417
Vendor advisory: https://www.postgresql.org/support/security/CVE-2023-39417
References
- https://access.redhat.com/errata/RHSA-2023:7545 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7579 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7580 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7581 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7616 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7656 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7666 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7667 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7694 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7695 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7714 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7770 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7772 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7784 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7785 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7883 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7884 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7885 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2024:0304 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2024:0332 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2024:0337 secalert@redhat.com
- https://access.redhat.com/security/cve/CVE-2023-39417 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2228111 secalert@redhat.com
- https://www.postgresql.org/support/security/CVE-2023-39417 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2023:7545 af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-11-01 04:33 UTC · record ↗