CVE-2024-0985 PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL

🗓️ 08 Feb 2024 13:00:02Reported by PostgreSQLType

PostgreSQL CVE-2024-0985 allows non-owner to execute arbitrary SQ

Reporter	Title	Published	Views	Family All 344
FreeBSD	postgresql-server -- non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL	8 Feb 202400:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	26 Mar 202504:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana (OnPrem) is affected by multiple security vulnerabilities	10 Jul 202407:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by a PostgreSQL vulnerability (CVE-2024-0985)	15 Jul 202419:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to security bypass due to PostgreSQL (CVE-2024-0985)	6 May 202404:19	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Commons Compress and PostgreSQL might affect IBM Storage Copy Data Management	30 Apr 202421:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities Affected for EDB	21 Jul 202513:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to security restrictions bypass in PostgreSQL [CVE-2024-0985]	25 Apr 202418:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities Affected for EDB	21 Jul 202513:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple PostgreSQL Vulnerabilities Affect IBM Storage Scale System	21 Jun 202415:45	–	ibm

[
  {
    "defaultStatus": "unaffected",
    "product": "PostgreSQL",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "16.2",
        "status": "affected",
        "version": "16",
        "versionType": "rpm"
      },
      {
        "lessThan": "15.6",
        "status": "affected",
        "version": "15",
        "versionType": "rpm"
      },
      {
        "lessThan": "14.11",
        "status": "affected",
        "version": "14",
        "versionType": "rpm"
      },
      {
        "lessThan": "13.14",
        "status": "affected",
        "version": "13",
        "versionType": "rpm"
      },
      {
        "lessThan": "12.18",
        "status": "affected",
        "version": "0",
        "versionType": "rpm"
      }
    ]
  }
]

Source	Link
postgresql	www.postgresql.org/support/security/CVE-2024-0985/
saites	www.saites.dev/projects/personal/postgres-cve-2024-0985/
lists	www.lists.debian.org/debian-lts-announce/2024/03/msg00017.html

10 Jul 2024 17:13Current

8.6High risk

Vulners AI Score8.6

CVSS 3.18

EPSS0.01465

CWE-271