KLA63867 OSI vulnerability in PostgreSQL

Privilege escalation vulnerability was found in PostgreSQL. Malicious users can exploit this vulnerability to execute arbitrary code, obtain sensitive information, cause denial of service.

Original advisories

CVE-2024-0985: PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL

Related products

PostgreSQL

CVE list

CVE-2024-0985 warning

Solution

Update to the latest version

Download PostgreSQL

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• PostgreSQL 15.x earlier than 15.6PostgreSQL 13.x earlier than 13.14PostgreSQL 12.x earlier than 12.18PostgreSQL 14.x earlier than 14.11