Dean Rasheed

Name of the Vulnerable Software and Affected Versions: PostgreSQL (affected versions not specified) Description: The PostgreSQL optimizer statistics feature can expose sampled data within a view, partition, or child table. This allows a user to read sampled data that they would not normally have access to. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions 15 and later **Description** A vulnerability was found in PostgreSQL with the use of the `MERGE` command, which fails to test new rows against row security policies defined for `UPDATE` and `SELECT`. If `UPDATE` and `SELECT` policies forbid some rows that `INSERT` policies do not forbid, a user could store such rows. This issue is related to shortcomings in access control. **Recommendations** For PostgreSQL version 15, consider disabling the `MERGE` command until a patch is available to prevent exploitation of this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions 9.5.x up to, excluding 9.5.17 PostgreSQL versions 9.6.x up to, excluding 9.6.13 PostgreSQL versions 10.x up to, excluding 10.8 PostgreSQL versions 11.x up to, excluding 11.3 **Description** The issue is related to an error in the security policy of PostgreSQL, where column values with SELECT privilege can be read. This can allow a remote attacker to gain access to confidential data. The problem arises because PostgreSQL does not evaluate row security policies before consulting column statistics during query planning. As a result, an attacker can exploit this to read the most common values of certain columns, specifically those for which the attacker has SELECT privilege. **Recommendations** For PostgreSQL versions 9.5.x up to, excluding 9.5.17, update to version 9.5.17 or later to resolve the issue. For PostgreSQL versions 9.6.x up to, excluding 9.6.13, update to version 9.6.13 or later to resolve the issue. For PostgreSQL versions 10.x up to, excluding 10.8, update to version 10.8 or later to resolve the issue. For PostgreSQL versions 11.x up to, excluding 11.3, update to version 11.3 or later to resolve the issue.