| Package | Affected versions | Patched versions |
|---|---|---|
| postgresql | ≥ 11.0, < 11.20≥ 12.0, < 12.15≥ 13.0, < 13.11≥ 14.0, < 14.8≥ 15.0, < 15.3 | 11.2012.1513.1114.815.3 |
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free