Detections
Analytics
Alpine: multiple postgresql15 packages: security update to 15.4-r0
high Tenable Cloud Security Plugin ID 406566
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@,
@extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an
administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with
database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. (CVE-2023-39417)
- A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows
against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some
rows that INSERT policies do not forbid, a user could store such rows. (CVE-2023-39418)
See Also
Plugin Details
Severity: High
ID: 406566
Version: Revision 1.28
Type: Local
Published: 10/31/2023
Updated: 11/4/2025
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: High
Score: 7.6
Percentile: 98.48
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2023-39417
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 8/10/2023
Reference Information
CVE: CVE-2023-39417, CVE-2023-39418
IAVB: 2023-B-0060-S