DescriptionIN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
postgresql-11 (PTS)buster11.16-0+deb10u1vulnerable
buster (security)11.20-0+deb10u1vulnerable
postgresql-13 (PTS)bullseye13.10-0+deb11u1vulnerable
bullseye (security)13.11-0+deb11u1vulnerable
postgresql-15 (PTS)bookworm15.3-0+deb12u1vulnerable
trixie, sid15.4-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[bookworm] - postgresql-15 <postponed> (Minor issue, fix along with next round of updates)
[bullseye] - postgresql-13 <postponed> (Minor issue, fix along with next round of updates);a=commitdiff;h=de494ec14f6bd7f2676623a5934723a6c8ba51c2 (REL_15_4);a=commitdiff;h=b1b585e0fc3dd195bc2e338c80760bede08de5f1 (REL_13_12);a=commitdiff;h=919ebb023e74546c6293352556365091c5402366 (REL_11_21)

Search for package or bug name: Reporting problems