BIT-postgresql-2023-39417

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/postgresql/BIT-postgresql-2023-39417.json
JSON Data
https://api.test.osv.dev/v1/vulns/BIT-postgresql-2023-39417
Aliases
Published
2024-03-06T11:03:15.187Z
Modified
2025-05-20T10:02:07.006Z
Summary
Postgresql: extension script @substitutions@ within quoting allow sql injection
Details

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

Database specific 
{
    "severity": "High",
    "cpes": [
        "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*"
    ]
}
References

Affected packages

Bitnami / postgresql

Package

Name
postgresql
Purl
pkg:bitnami/postgresql

Severity

  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
11.0.0
Fixed
11.21.0
Introduced
12.0.0
Fixed
12.16.0
Introduced
13.0.0
Fixed
13.12.0
Introduced
14.0.0
Fixed
14.9.0
Introduced
15.0.0
Fixed
15.4.0

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/postgresql/BIT-postgresql-2023-39417.json"