PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY… (CVE-2024-0985)

Résumé

PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami postgresql

[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"12.18.0"},{"introduced":"13.0.0"},{"fixed":"13.14.0"},{"introduced":"14.0.0"},{"fixed":"14.11.0"},{"introduced":"15.0.0"},{"fixed":"15.6.0"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2024-0985 postgresql-13 Corrigé dans: 13.14-0+deb11u1

Résumé

Description d'origine

Paquets affectés

État des correctifs par distribution

Références