Ubuntu.comUB:CVE-2024-4317CVE-2024-4317
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
9.0%
Missing authorization in PostgreSQL built-in views pg_stats_ext and
pg_stats_ext_exprs allows an unprivileged database user to read most common
values and other statistics from CREATE STATISTICS commands of other users.
The most common values may reveal column values the eavesdropper could not
otherwise read or results of functions they cannot execute. Installing an
unaffected version only fixes fresh PostgreSQL installations, namely those
that are created with the initdb utility after installing that version.
Current PostgreSQL installations will remain vulnerable until they follow
the instructions in the release notes. Within major versions 14-16, minor
versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions
before PostgreSQL 14 are unaffected.
Notes
| Author | Note |
|---|---|
| leosilva | PostgreSQL 9.3 is end of life upstream, and no updates are are available. Marking as deferred in -esm-main releases. |
| mdeslaur | only affects 14.x to 16.x |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 22.04 | noarch | postgresql-14 | < 14.12-0ubuntu0.22.04.1 | UNKNOWN |
| ubuntu | 23.10 | noarch | postgresql-15 | < 15.7-0ubuntu0.23.10.1 | UNKNOWN |
| ubuntu | 24.04 | noarch | postgresql-16 | < 16.3-0ubuntu0.24.04.1 | UNKNOWN |
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
9.0%