Postgresql: extension script @substitutions@ within quoting allow sql injection

Summary

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

Timeline

1. Aug 11, 2023, 12:19 PM UTCCVE published
2. Jul 9, 2025, 1:38 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Sep 30, 2026, 7:07 PM UTCRecord last updated

Affected versions

• advanced-cluster-security/rhacs-central-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-main-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-operator-bundle

  Version range not reported

• advanced-cluster-security/rhacs-scanner-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-db-slim-rhel8

  Version range not reported

• postgresql:13

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:15

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:13

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:13

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:13

  Version range not reported

• postgresql:13

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:13

  Version range not reported

• postgresql:12

  Version range not reported

• postgresql:15

  Version range not reported

• postgresql

  Version range not reported

• postgresql:15

  Version range not reported

• postgresql

  Version range not reported

• postgresql

  Version range not reported

• postgresql:15

  Version range not reported

• rh-postgresql12-postgresql

  Version range not reported

• rh-postgresql13-postgresql

  Version range not reported

• advanced-cluster-security/rhacs-central-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-main-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-operator-bundle

  Version range not reported

• advanced-cluster-security/rhacs-scanner-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-db-slim-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-central-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-main-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-operator-bundle

  Version range not reported

• advanced-cluster-security/rhacs-scanner-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-db-slim-rhel8

  Version range not reported

• postgresql

  Version range not reported

• postgresql

  Version range not reported

• postgresql:10/postgresql

  Version range not reported

• rh-postgresql10-postgresql

  Version range not reported

• postgresqlBitnami

  From 11.0.0 · fixed in 11.21.0; From 12.0.0 · fixed in 12.16.0; From 13.0.0 · fixed in 13.12.0; From 14.0.0 · fixed in 14.9.0; From 15.0.0 · fixed in 15.4.0

References 24