CVE-2023-39418

Medium

Advisory

Published 11 Aug 2023In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.3; base score, highest
EPSS: 0.011; 63rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 52; of 17,781 indexed, latest versions
Container images: 48; deployed by those charts
Fix available: 5 of 5; affected packages

Postgresql: merge fails to enforce update or select row security policies

Carried by container images the latest versions of 52 of 17,781 indexed charts deploy, on 48 images.

Affected package	Affected versions	Fixed in	Images
postgresql14apk	14.1-r5, 14.2-r0, 14.4-r0, 14.5-r0+1 more	14.9-r0	19
postgresql-15deb	15.3-0+deb12u1, 15.3-1.pgdg120+1, 15.4-2.pgdg120+1	15.5-0+deb12u1	19
postgresql15apk	15.1-r0, 15.2-r0, 15.3-r0	15.4-r0	6
postgresqlbitnami	15.2.0-4, 15.3.0-3, 15.3.0-9, 15.4.0-6	15.4.0	4
PostgreSQLbitnami	15.3.0	15.4.0	2

OSV records: ALPINE-CVE-2023-39418 BIT-postgresql-2023-39418 DEBIAN-CVE-2023-39418

Charts affected

52 by stars

Chart

Latest

Affected images

Radar Score

demo-backendv2fly

0.0.3

1 of 1 See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2023-39418.

Container image	Digest	Package	Fixed in
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1

Open the chart page →

14,358

webresourcecataloguswebresourcecatalogus

1.1.0

1 of 4 See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2023-39418.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	postgresql14@14.2-r0	14.9-r0

Open the chart page →

7,552

Container images carrying it

48 by charts deploying them

A fixed version is listed for 5 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
bitnamilegacy/postgresql :15.4.0-debian-11-r45	5dba7e6a514d	postgresql@15.4.0-6	15.4.0	4
bitnamilegacy/postgresql :15.3.0-debian-11-r7	cc301eef7436	postgresql@15.3.0-3 PostgreSQL@15.3.0	15.4.0 15.4.0	3
gjeanmart/safe-ganache-node :latest	926264c8f2d1	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	2
library/python :3.7	eedf63967cdb	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	2
pecan/db :latest	9a1cdc3a9ccb	postgresql14@14.1-r5	14.9-r0	2
privatebin/pdo :1.3.5	00466418121c	postgresql14@14.2-r0	14.9-r0	2
akaunting/akaunting :3.0.15	52811b36ec3a	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	1
alexeyr7/sf-test-app :latest	df0b41fdbd53	postgresql14@14.4-r0	14.9-r0	1
ankane/pgvector :v0.5.1	d3a9d8ac27bb	postgresql-15@15.4-2.pgdg120+1	15.5-0+deb12u1	1
assistiot/smart-orchestrator_scheduler_mc :latest	b1dbe4d62a03	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	1
avinash263/pyredis263 :latest	aa2b8727f1a6	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	1
bitnamilegacy/postgresql :15.2.0-debian-11-r11	3e65a6b89e38	postgresql@15.2.0-4	15.4.0	1
bitnamilegacy/postgresql :15.3.0-debian-11-r77	5f4cf61668e5	postgresql@15.3.0-9 PostgreSQL@15.3.0	15.4.0 15.4.0	1
eclipseaerios/self-service-password :5.2.3	2f93bfa4cf0d	postgresql14@14.4-r0	14.9-r0	1
evgkrsk/postgres-controller :0.6.2	37f0e1f435c3	postgresql15@15.1-r0	15.4-r0	1
firefart/requesttracker :5.0.4	0d6249906d8c	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	1
helicone/supabase-migration-runner :v2025.03.05-1	4a913936c97b	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	1
ihatemoney/ihatemoney :5.2.0	457fda1feb32	postgresql14@14.2-r0	14.9-r0	1
kfirfer/scripts :0.0.24	81e5c4e5d70e	postgresql14@14.5-r0	14.9-r0	1
library/postgres :15.3	8775adb39f0d	postgresql-15@15.3-1.pgdg120+1	15.5-0+deb12u1	1
librenms/librenms :22.4.1	4f1f3d667cc7	postgresql14@14.2-r0	14.9-r0	1
linuxserver/healthchecks :2.7.20230331	94696dab3c50	postgresql15@15.2-r0	15.4-r0	1
mintproject/data-catalog :9be70359feabe03ed55bfdbf92c20a7e43ab928b	67d2f2103085	postgresql14@14.8-r0	14.9-r0	1
mintproject/data-catalog-db :9be70359feabe03ed55bfdbf92c20a7e43ab928b	9bf26fedd848	postgresql14@14.5-r0	14.9-r0	1
pgpool/pgpool :latest	3782cbf9bb0c	postgresql15@15.2-r0	15.4-r0	1
phntom/postgresql-backup-s3 :1.0.22	49b6488f618b	postgresql15@15.1-r0	15.4-r0	1
postgis/postgis :10-3.2-alpine	7e3e68a36d53	postgresql14@14.5-r0	14.9-r0	1
socialmediamacroscope/histogram :0.1.2	6418f9bdb4d2	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	1
socialmediamacroscope/network_analysis :0.1.3	b351c21422e6	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	1
socialmediamacroscope/preprocessing :0.1.3	ca863306314b	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	1
socialmediamacroscope/topic_modeling :0.1.3	fa490acac2f8	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	1
temporalio/admin-tools :1.22.0	836af062af30	postgresql15@15.3-r0	15.4-r0	1
thongngo3301/stakefish :latest	a341af5976e3	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	1
vlebediantsev/notes-admin-front :latest	007c6670ff48	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	1
vlebediantsev/notes-project-front :latest	945675fd2636	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	1
vlebediantsev/registration-ms-front-app-host :latest	54f69d116c50	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	1
volkerraschek/postfixadmin-fetchmail :0.3.0	e4cf12c6249d	postgresql15@15.1-r0	15.4-r0	1
ghcr.io/conductionnl/berichtservice-php :latest	ee6a21e66ff0	postgresql14@14.2-r0	14.9-r0	1
ghcr.io/conductionnl/contactcatalogus-php :latest	eeb625bd660c	postgresql14@14.2-r0	14.9-r0	1
ghcr.io/conductionnl/eav-component-php :latest	24bbca4a52a8	postgresql14@14.2-r0	14.9-r0	1
ghcr.io/conductionnl/education-component-php :latest	da6b05a1a601	postgresql14@14.2-r0	14.9-r0	1
ghcr.io/conductionnl/medewerkercatalogus-php :latest	1ea5412bed26	postgresql14@14.2-r0	14.9-r0	1
ghcr.io/conductionnl/user-component-php :latest	198db44fabb5	postgresql14@14.2-r0	14.9-r0	1
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	postgresql14@14.2-r0	14.9-r0	1
ghcr.io/dodevops/azure-advanced-backup :0.4.0	1041d4449e49	postgresql14@14.5-r0	14.9-r0	1
ghcr.io/mjohnson9/docker-pleroma :v0.1.4	4f08e2823756	postgresql14@14.5-r0	14.9-r0	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	postgresql-15@15.3-0+deb12u1	15.5-0+deb12u1	1