CVE-2024-2338 is a high severity (8.0) flaw in PostgreSQL Anonymizer 1.2: a SQL injection that allows a user who owns a table to elevate to superuser when dynamic masking is enabled. The record says version 1.3 resolves the problem. Upgrade the extension to 1.3 or later.
Weakness: CWE-89 (SQL Injection).
What's affected
- Affected: Dalibo PostgreSQL Anonymizer v1.2 (CPE 1.2.0).
- Fixed: version 1.3, per the record.
- Attack conditions:
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. Attack complexity is high and high privileges are needed, since the attacker must already own a table, but scope is changed because the result is superuser.
a SQL injection that allows a user who owns a table to elevate to superuser when dynamic masking is enabled. The flaw is that complex expressions can be supplied as a masking value and are later used as is to build masked views.
Dynamic masking must be enabled, and the attacker must own a table. Users who do not own a table, including masked users, cannot exploit it, according to the record.
How to check if you're exposed
PostgreSQL Anonymizer is a database extension, so check inside the database.
- Run
SELECT extname, extversion FROM pg_extension WHERE extname = 'anon';in each database to see the installed version. - List which roles own tables that carry masking security labels, for example by querying
pg_seclabels. - Check whether dynamic masking is enabled in your configuration.
If you build images, also check the extension package version in your Dockerfiles.
What to do now
- Upgrade the anon extension to 1.3 or later and run the extension update step in each database that uses it.
- Until upgraded, do not apply static masking or anonymous dump with a privileged account on tables owned by users you do not trust.
- Review which roles own masked tables and reduce table ownership to those who need it.
- After upgrading, review security labels on tables for unexpected expressions or functions.
- Record the extension version in your inventory.
Why it matters
The record classes this as CWE-89 (SQL Injection). Both issues come from the same pattern: data or code defined by a lower-privileged user is later executed by a more privileged one. In a masking tool, the privileged step is the one that builds masked views or runs masking functions, so anything a table owner can plant there runs with superuser rights.
NVD scored it 8.0 (High), held down by high complexity and the need for table ownership. The sibling issue is CVE-2024-2339, also fixed in 1.3. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2024-2338?
The record says PostgreSQL Anonymizer 1.3 resolves it.
Are masked users at risk?
The record says users who do not own a table, especially masked users, cannot exploit it.
Sources
- CVE-2024-2338 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2338, as held in the batch record
- Upstream fix commit
Last reviewed: 19 October 2026.
