CVE-2024-2338

PostgreSQL Anonymizer v1.2 contains a SQL injection vulnerability that allows a user who owns a table to elevate to superuser when dynamic masking is enabled. PostgreSQL Anonymizer enables users to set security labels on tables to mask specified columns. There is a flaw that allows complex expressions to be provided as a value. This expression is then later used as it to create the masked views leading to SQL Injection. If dynamic masking is enabled, this will lead to privilege escalation to superuser after the label is created. Users that don't own a table, especially masked users cannot exploit this vulnerability. The problem is resolved in v1.3.

• CWE-89
• CWE-89

• https://gitlab.com/dalibo/postgresql_anonymizer/-/commit/f55daadba3fa8226029687964aa8889d01a79778Patch
• https://gitlab.com/dalibo/postgresql_anonymizer/-/commit/f55daadba3fa8226029687964aa8889d01a79778Patch

Published

Mar 8, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23374Memory corruption is possible when an attempt is made from u…6.7
• CVE-2024-23375Memory corruption during the network scan request.6.7
• CVE-2024-23376Memory corruption while sending the persist buffer command p…6.7
• CVE-2024-23377Memory corruption while invoking IOCTL command from user-spa…6.7
• CVE-2024-23378Memory corruption while invoking IOCTL calls for MSM module …6.7
• CVE-2024-23379Memory corruption while unmapping the fastrpc map when two t…6.7
• CVE-2024-23380Memory corruption while handling user packets during VBO bin…7.8
• CVE-2024-23381Memory corruption when memory mapped in a VBO is not unmappe…7.8
• CVE-2024-23382Memory corruption while processing graphics kernel driver re…7.8
• CVE-2024-23383Memory corruption when kernel driver attempts to trigger har…7.8
• CVE-2024-23384Memory corruption when the mapped pages in VBO are still map…8.4
• CVE-2024-23385Transient DOS as modem reset occurs when an unexpected MAC R…6.5