CVE-2024-2339 is a high severity (8.0) flaw in PostgreSQL Anonymizer 1.2: a privilege escalation that allows a user who owns a table to become superuser. The record says version 1.3 resolves the problem. Upgrade the extension to 1.3 or later. NVD published it on 2024-03-08.
Weakness: CWE-20 (Improper Input Validation).
What's affected
- Affected: Dalibo PostgreSQL Anonymizer v1.2 (CPE 1.2.0).
- Fixed: version 1.3, per the record.
- Attack conditions:
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. Attack complexity is high and high privileges are needed, since the attacker must already own a table, but scope is changed because the result is superuser.
a privilege escalation that allows a user who owns a table to become superuser. A table owner can define a masking function that contains malicious code, and it runs when a privileged user applies static masking or the anonymous dump method.
A privileged user must apply static masking or anonymous dump on rules the attacker defined. The record says the restrict_to_trusted_schemas option exists in 1.2 but its protection is incomplete. Users who do not own a table cannot exploit it.
How to check if you're exposed
PostgreSQL Anonymizer is a database extension, so check inside the database.
- Run
SELECT extname, extversion FROM pg_extension WHERE extname = 'anon';in each database to see the installed version. - List which roles own tables that carry masking security labels, for example by querying
pg_seclabels. - Check whether dynamic masking is enabled in your configuration.
If you build images, also check the extension package version in your Dockerfiles.
What to do now
- Upgrade the anon extension to 1.3 or later and run the extension update step in each database that uses it.
- Until upgraded, do not apply static masking or anonymous dump with a privileged account on tables owned by users you do not trust.
- Review which roles own masked tables and reduce table ownership to those who need it.
- After upgrading, review security labels on tables for unexpected expressions or functions.
- Record the extension version in your inventory.
Why it matters
The record classes this as CWE-20 (Improper Input Validation). Both issues come from the same pattern: data or code defined by a lower-privileged user is later executed by a more privileged one. In a masking tool, the privileged step is the one that builds masked views or runs masking functions, so anything a table owner can plant there runs with superuser rights.
NVD scored it 8.0 (High), held down by high complexity and the need for table ownership. The sibling issue is CVE-2024-2338, also fixed in 1.3. The KEV flag is false.
Quick check
Which version fixes CVE-2024-2339?
The record says PostgreSQL Anonymizer 1.3 resolves it.
Are masked users at risk?
The record says users who do not own a table, especially masked users, cannot exploit it.
Sources
- CVE-2024-2339 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2339, as held in the batch record
- Upstream fix commit
Last reviewed: 19 October 2026.
