CVE-2024-0985

🗓️ 08 Feb 2024 13:00:02Reported by PostgreSQLType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 517 Views

Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows execution of arbitrary SQL functions by the object creator

Reporter	Title	Published	Views	Family All 343
FreeBSD	postgresql-server -- non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL	8 Feb 202400:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	26 Mar 202504:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana (OnPrem) is affected by multiple security vulnerabilities	10 Jul 202407:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by a PostgreSQL vulnerability (CVE-2024-0985)	15 Jul 202419:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to security bypass due to PostgreSQL (CVE-2024-0985)	6 May 202404:19	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Commons Compress and PostgreSQL might affect IBM Storage Copy Data Management	30 Apr 202421:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities Affected for EDB	21 Jul 202513:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to security restrictions bypass in PostgreSQL [CVE-2024-0985]	25 Apr 202418:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities Affected for EDB	21 Jul 202513:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple PostgreSQL Vulnerabilities Affect IBM Storage Scale System	21 Jun 202415:45	–	ibm

NVD

Node

postgresql postgresqlRange12.0–12.18

postgresql postgresqlRange13.0–13.14

postgresql postgresqlRange14.0–14.11

postgresql postgresqlRange15.0–15.6

[
  {
    "defaultStatus": "unaffected",
    "product": "PostgreSQL",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "16.2",
        "status": "affected",
        "version": "16",
        "versionType": "rpm"
      },
      {
        "lessThan": "15.6",
        "status": "affected",
        "version": "15",
        "versionType": "rpm"
      },
      {
        "lessThan": "14.11",
        "status": "affected",
        "version": "14",
        "versionType": "rpm"
      },
      {
        "lessThan": "13.14",
        "status": "affected",
        "version": "13",
        "versionType": "rpm"
      },
      {
        "lessThan": "12.18",
        "status": "affected",
        "version": "0",
        "versionType": "rpm"
      }
    ]
  }
]

Source	Link
postgresql	www.postgresql.org/support/security/CVE-2024-0985/
lists	www.lists.debian.org/debian-lts-announce/2024/03/msg00017.html
saites	www.saites.dev/projects/personal/postgres-cve-2024-0985/
security	www.security.netapp.com/advisory/ntap-20241220-0005/

20 Dec 2024 13:15Current

8.6High risk

Vulners AI Score8.6

CVSS 3.18

EPSS0.00753

SSVC

CWE-271