CVE-2023-39418: debian debian_linux
CVSS: 4.3v3.1MediumModified
AliasesALPINE-CVE-2023-39418DEBIAN-CVE-2023-39418
Published 11-08-2023Last modified 21-11-2025
Vulnerability summary
CVE-2023-39418 is a medium (CVSS 4.3) vulnerability in debian debian_linux. EPSS estimates a 1.09% chance of exploitation in the next 30 days, higher than 64.7% of scored vulnerabilities.
CVSS score
4.3/10
010
Medium · v3.1 (NVD)EPSS score
1.09%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Related 3Timeline
- 11-08-2023PublishedVulnerability first disclosed.
- 21-11-2025Last modifiedVulnerability information updated.
Description
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 4.3Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NSources4 sources · 3.1–4.3
- CVE.orgCNA3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · AlpineEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
1.09%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
+0.01 pp
From 1.08% on 19-09-2026
19-09-202619-10-2026
EPSS score1.09%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine4 products
- postgresql≥ 15.0, < 13.12-r0
- postgresql13< 13.12-r0
- postgresql14< 14.9-r0
- postgresql15< 15.4-r0
Debian2 products
- postgresql-15< 15.5-0+deb12u1
- debian_linux12.0
Postgresql1 product
- postgresql≥ 15.0, < 15.4
Redhat1 product
- enterprise_linux8.0 | 9.0
4 vendors · 8 products
References
12 links- bugzilla.redhat.com/show_bug.cgi?id=2228112Issue TrackingX Refsource REDHATPatchThird Party Advisory
- www.postgresql.org/support/security/CVE-2023-39418/Vendor Advisory
- security.netapp.com/advisory/ntap-20230915-0002/X Transferred
www.debian.org/security/2023/dsa-5553X Transferred