Dean Rasheed

Nome do Software Vulnerável e Versões Afetadas: PostgreSQL (versões afetadas não especificadas) Descrição: A funcionalidade de estatísticas do otimizador do PostgreSQL pode expor dados amostrados em uma view, partição ou tabela filha. Isso permite que um usuário leia dados amostrados aos quais não teria acesso normalmente. Recomendações: No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions 15 and later **Description** A vulnerability was found in PostgreSQL with the use of the `MERGE` command, which fails to test new rows against row security policies defined for `UPDATE` and `SELECT`. If `UPDATE` and `SELECT` policies forbid some rows that `INSERT` policies do not forbid, a user could store such rows. This issue is related to shortcomings in access control. **Recommendations** For PostgreSQL version 15, consider disabling the `MERGE` command until a patch is available to prevent exploitation of this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions 9.5.x up to, excluding 9.5.17 PostgreSQL versions 9.6.x up to, excluding 9.6.13 PostgreSQL versions 10.x up to, excluding 10.8 PostgreSQL versions 11.x up to, excluding 11.3 **Description** The issue is related to an error in the security policy of PostgreSQL, where column values with SELECT privilege can be read. This can allow a remote attacker to gain access to confidential data. The problem arises because PostgreSQL does not evaluate row security policies before consulting column statistics during query planning. As a result, an attacker can exploit this to read the most common values of certain columns, specifically those for which the attacker has SELECT privilege. **Recommendations** For PostgreSQL versions 9.5.x up to, excluding 9.5.17, update to version 9.5.17 or later to resolve the issue. For PostgreSQL versions 9.6.x up to, excluding 9.6.13, update to version 9.6.13 or later to resolve the issue. For PostgreSQL versions 10.x up to, excluding 10.8, update to version 10.8 or later to resolve the issue. For PostgreSQL versions 11.x up to, excluding 11.3, update to version 11.3 or later to resolve the issue.