--- id: CVE-2023-39417 title: >- IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or "") summary: >- IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vu… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-89 vendor: postgresql product: postgresql affected: - 'postgresql >= 11.0, < 11.21' - 'postgresql >= 12.0, < 12.16' - 'postgresql >= 13.0, < 13.12' - 'postgresql >= 14.0, < 14.9' - 'postgresql >= 15.0, < 15.4' - software_collections - enterprise_linux = 8.0 - enterprise_linux = 9.0 - debian_linux = 8.0 - debian_linux = 11.0 - debian_linux = 12.0 patched: - postgresql 15.4 published: '2023-08-11' updated: '2026-09-30' sourceUpdated: '2026-09-30T20:17:12.770' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-39417' references: - url: 'https://access.redhat.com/errata/RHSA-2023:7545' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7579' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7580' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7581' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7616' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7656' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7666' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7667' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7694' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7695' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7714' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7770' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7772' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7784' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7785' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7883' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7884' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7885' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:0304' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:0332' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:0337' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2023-39417' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2228111' label: secalert@redhat.com - url: 'https://www.postgresql.org/support/security/CVE-2023-39417' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7545' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7579' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7580' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7581' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7616' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7656' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7666' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7667' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7694' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7695' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7714' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7770' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7772' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7784' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7785' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7883' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7884' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7885' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:0304' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:0332' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:0337' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/security/cve/CVE-2023-39417' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2228111' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2023/10/msg00003.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2026/09/msg00039.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20230915-0002/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2023/dsa-5553' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2023/dsa-5554' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.postgresql.org/support/security/CVE-2023-39417' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd - cve.org ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2025-07-09T13:38:12.203477Z' epss: 0.01676 epssPercentile: 0.75996 ingestedAt: '2026-09-30T20:23:19.429Z' --- ## Overview IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. ## Affected - `postgresql >= 11.0, < 11.21` - `postgresql >= 12.0, < 12.16` - `postgresql >= 13.0, < 13.12` - `postgresql >= 14.0, < 14.9` - `postgresql >= 15.0, < 15.4` - `software_collections` - `enterprise_linux = 8.0` - `enterprise_linux = 9.0` - `debian_linux = 8.0` - `debian_linux = 11.0` - `debian_linux = 12.0` ## Remediation Upgrade past the affected range: - `postgresql 15.4`