USN-6656-1 — postgresql-12, postgresql-14, postgresql-15 vulnerability

Summary

It was discovered that PostgreSQL incorrectly handled dropping privileges
when handling REFRESH MATERIALIZED VIEW CONCURRENTLY commands. If a user or
automatic system were tricked into running a specially crafted command, a
remote attacker could possibly use this issue to execute arbitrary SQL
functions.

Fixed packages 2

Release	Package	Fixed in
Ubuntu · 20.04 LTS 20.04:LTS	postgresql-12	12.18-0ubuntu0.20.04.1
Ubuntu · 22.04 LTS 22.04:LTS	postgresql-14	14.11-0ubuntu0.22.04.1

Vulnerabilities 1

High 8.0

CVE-2024-0985

PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL

Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refres…

postgresql-15 postgresql-9.3 postgresql15 postgresql-9.5 Debian Ubuntu Azure Linux Alpine Wolfi

Feb 8, 2024

References

report
https://ubuntu.com/security/CVE-2024-0985

postgresql-12, postgresql-14, postgresql-15 vulnerability

Summary

Fixed packages 2

Vulnerabilities 1

PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL

References