Summary
PostgreSQL is an advanced object-relational database management system (DBMS).
Security Fix(es):
* postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 18
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | pg_repack | 1.4.8-1.module_el8.8.0+3487+43ec1b9f |
| AlmaLinux · 8 | pgaudit | 1.7.0-1.module_el8.8.0+3487+43ec1b9f |
| AlmaLinux · 8 | postgres-decoderbufs | 1.9.7-1.Final.module_el8.8.0+3487+43ec1b9f |
| AlmaLinux · 8 | postgresql | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
| AlmaLinux · 8 | postgresql-contrib | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
| AlmaLinux · 8 | postgresql-docs | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
| AlmaLinux · 8 | postgresql-plperl | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
| AlmaLinux · 8 | postgresql-plpython3 | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
| AlmaLinux · 8 | postgresql-pltcl | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
| AlmaLinux · 8 | postgresql-private-devel | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
| AlmaLinux · 8 | postgresql-private-libs | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
| AlmaLinux · 8 | postgresql-server | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
| AlmaLinux · 8 | postgresql-server-devel | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
| AlmaLinux · 8 | postgresql-static | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
| AlmaLinux · 8 | postgresql-test | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
| AlmaLinux · 8 | postgresql-test-rpm-macros | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
| AlmaLinux · 8 | postgresql-upgrade | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
| AlmaLinux · 8 | postgresql-upgrade-devel | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
Vulnerabilities 1
-
High 8.0
PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL
Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refres…