Lucene search

DebianDEBIAN:DSA-5623-1:3E353

HistoryFeb 14, 2024 - 8:00 p.m.

[SECURITY] [DSA 5623-1] postgresql-15 security update

2024-02-1420:00:02

lists.debian.org

cve-2024-0985

postgresql-15

security advisory

vulnerability

debian

privilege drop

fixed

8.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.4%

JSON

Debian Security Advisory DSA-5623-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
February 14, 2024 https://www.debian.org/security/faq

Package : postgresql-15
CVE ID : CVE-2024-0985

It was discovered that a late privilege drop in the "REFRESH MATERIALIZED
VIEW CONCURRENTLY" command could allow an attacker to trick a user with
higher privileges to run SQL commands with these permissions.

For the stable distribution (bookworm), this problem has been fixed in
version 15.6-0+deb12u1.

We recommend that you upgrade your postgresql-15 packages.

For the detailed security status of postgresql-15 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/postgresql-15

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian12allpostgresql-client-15< 15.6-0+deb12u1postgresql-client-15_15.6-0+deb12u1_all.deb
Debian12allpostgresql-15< 15.6-0+deb12u1postgresql-15_15.6-0+deb12u1_all.deb
Debian12alllibecpg-dev< 15.6-0+deb12u1libecpg-dev_15.6-0+deb12u1_all.deb
Debian12allpostgresql-plperl-15< 15.6-0+deb12u1postgresql-plperl-15_15.6-0+deb12u1_all.deb
Debian12allpostgresql-pltcl-15< 15.6-0+deb12u1postgresql-pltcl-15_15.6-0+deb12u1_all.deb
Debian12alllibpq5< 15.6-0+deb12u1libpq5_15.6-0+deb12u1_all.deb
Debian12alllibecpg-compat3< 15.6-0+deb12u1libecpg-compat3_15.6-0+deb12u1_all.deb
Debian12allpostgresql-server-dev-15< 15.6-0+deb12u1postgresql-server-dev-15_15.6-0+deb12u1_all.deb
Debian12alllibpgtypes3< 15.6-0+deb12u1libpgtypes3_15.6-0+deb12u1_all.deb
Debian12alllibecpg6< 15.6-0+deb12u1libecpg6_15.6-0+deb12u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	postgresql-client-15	< 15.6-0+deb12u1	postgresql-client-15_15.6-0+deb12u1_all.deb
Debian	12	all	postgresql-15	< 15.6-0+deb12u1	postgresql-15_15.6-0+deb12u1_all.deb
Debian	12	all	libecpg-dev	< 15.6-0+deb12u1	libecpg-dev_15.6-0+deb12u1_all.deb
Debian	12	all	postgresql-plperl-15	< 15.6-0+deb12u1	postgresql-plperl-15_15.6-0+deb12u1_all.deb
Debian	12	all	postgresql-pltcl-15	< 15.6-0+deb12u1	postgresql-pltcl-15_15.6-0+deb12u1_all.deb
Debian	12	all	libpq5	< 15.6-0+deb12u1	libpq5_15.6-0+deb12u1_all.deb
Debian	12	all	libecpg-compat3	< 15.6-0+deb12u1	libecpg-compat3_15.6-0+deb12u1_all.deb
Debian	12	all	postgresql-server-dev-15	< 15.6-0+deb12u1	postgresql-server-dev-15_15.6-0+deb12u1_all.deb
Debian	12	all	libpgtypes3	< 15.6-0+deb12u1	libpgtypes3_15.6-0+deb12u1_all.deb
Debian	12	all	libecpg6	< 15.6-0+deb12u1	libecpg6_15.6-0+deb12u1_all.deb

Rows per page:

1-10 of 131