CVE-2024-2338

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-2338
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2338.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-2338
Published
2024-03-08T20:15:45Z
Modified
2024-10-08T04:01:18.318247Z
Summary
[none]
Details

PostgreSQL Anonymizer v1.2 contains a SQL injection vulnerability that allows a user who owns a table to elevate to superuser when dynamic masking is enabled. PostgreSQL Anonymizer enables users to set security labels on tables to mask specified columns. There is a flaw that allows complex expressions to be provided as a value. This expression is then later used as it to create the masked views leading to SQL Injection. If dynamic masking is enabled, this will lead to privilege escalation to superuser after the label is created. Users that don't own a table, especially masked users cannot exploit this vulnerability. The problem is resolved in v1.3.

References

Affected packages

Git / gitlab.com/dalibo/postgresql_anonymizer

Affected ranges

Type
GIT
Repo
https://gitlab.com/dalibo/postgresql_anonymizer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

0.*

0.0.1
0.0.3
0.1.1
0.10.0
0.11.0
0.12.0
0.2.1
0.3.0
0.3.1
0.4.0
0.4.1
0.5.0
0.6.0
0.7.0
0.7.1
0.8.0
0.9.0

1.*

1.0.0
1.1.0
1.2.0