CVE-2024-0985 PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL
An attacker can execute arbitrary SQL as a superuser by tricking them into refreshing a malicious materialized view concurrently.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-0985?
CVE-2024-0985 is a high-severity vulnerability in Postgresql Postgresql, published on 8 Feb 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.
Weakness: CWE-271
Which versions are affected by CVE-2024-0985?
1 open source package ship an affected version, including postgresql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | From 12.0.0 | 12.18.0, 13.14.0, 14.11.0, 15.6.0 |
Linux distribution packages (39)
pg_repack AlmaLinux:8 | All versions | 1.4.6-3.module_el8.6.0+2758+4f4474df |
pg_repack AlmaLinux:8 | All versions | 1.4.6-3.module_el8.6.0+2760+1746ec94 |
pg_repack AlmaLinux:8 | All versions | 1.4.6-3.module_el8.6.0+3094+eb237fb8 |
pg_repack AlmaLinux:8 | All versions | 1.4.6-3.module_el8.6.0+3095+ee60d910 |
pg_repack AlmaLinux:8 | All versions | 1.4.6-3.module_el8.9.0+3704+f1f917ce |
pg_repack AlmaLinux:8 | All versions | 1.4.8-1.module_el8.8.0+3487+43ec1b9f |
pgaudit AlmaLinux:8 | All versions | 1.4.0-7.module_el8.9.0+3740+0e74851f.alma.1 |
pgaudit AlmaLinux:8 | All versions | 1.5.0-1.module_el8.6.0+2760+1746ec94 |
pgaudit AlmaLinux:8 | All versions | 1.5.0-1.module_el8.6.0+3095+ee60d910 |
pgaudit AlmaLinux:8 | All versions | 1.7.0-1.module_el8.8.0+3487+43ec1b9f |
postgres-decoderbufs AlmaLinux:8 | All versions | 0.10.0-2.module_el8.6.0+2758+4f4474df |
postgres-decoderbufs AlmaLinux:8 | All versions | 0.10.0-2.module_el8.6.0+2760+1746ec94 |
postgres-decoderbufs AlmaLinux:8 | All versions | 0.10.0-2.module_el8.6.0+3094+eb237fb8 |
postgres-decoderbufs AlmaLinux:8 | All versions | 0.10.0-2.module_el8.6.0+3095+ee60d910 |
postgres-decoderbufs AlmaLinux:8 | All versions | 0.10.0-2.module_el8.9.0+3704+f1f917ce |
postgres-decoderbufs AlmaLinux:8 | All versions | 1.9.7-1.Final.module_el8.8.0+3487+43ec1b9f |
postgresql AlmaLinux:8 | All versions | 10.23-4.module_el8.9.0+3736+952d0ed7.alma.1 |
postgresql AlmaLinux:8 | All versions | 12.18-1.module_el8.9.0+3740+0e74851f.alma.1 |
postgresql AlmaLinux:8 | All versions | 13.14-1.module_el8.9.0+3738+d55e2165.alma.1 |
postgresql AlmaLinux:8 | All versions | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
postgresql-contrib AlmaLinux:8 | All versions | 10.23-4.module_el8.9.0+3736+952d0ed7.alma.1 |
postgresql-contrib AlmaLinux:8 | All versions | 12.18-1.module_el8.9.0+3740+0e74851f.alma.1 |
postgresql-contrib AlmaLinux:8 | All versions | 13.14-1.module_el8.9.0+3738+d55e2165.alma.1 |
postgresql-contrib AlmaLinux:8 | All versions | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
postgresql-docs AlmaLinux:8 | All versions | 10.23-4.module_el8.9.0+3736+952d0ed7.alma.1 |
postgresql-docs AlmaLinux:8 | All versions | 12.18-1.module_el8.9.0+3740+0e74851f.alma.1 |
postgresql-docs AlmaLinux:8 | All versions | 13.14-1.module_el8.9.0+3738+d55e2165.alma.1 |
postgresql-docs AlmaLinux:8 | All versions | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
postgresql-plperl AlmaLinux:8 | All versions | 10.23-4.module_el8.9.0+3736+952d0ed7.alma.1 |
postgresql-plperl AlmaLinux:8 | All versions | 12.18-1.module_el8.9.0+3740+0e74851f.alma.1 |
postgresql-plperl AlmaLinux:8 | All versions | 13.14-1.module_el8.9.0+3738+d55e2165.alma.1 |
postgresql-plperl AlmaLinux:8 | All versions | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
postgresql-plpython3 AlmaLinux:8 | All versions | 10.23-4.module_el8.9.0+3736+952d0ed7.alma.1 |
postgresql-plpython3 AlmaLinux:8 | All versions | 12.18-1.module_el8.9.0+3740+0e74851f.alma.1 |
postgresql-plpython3 AlmaLinux:8 | All versions | 13.14-1.module_el8.9.0+3738+d55e2165.alma.1 |
postgresql-plpython3 AlmaLinux:8 | All versions | 15.6-1.module_el8.9.0+3739+514705ed.alma.1 |
postgresql-pltcl AlmaLinux:8 | All versions | 10.23-4.module_el8.9.0+3736+952d0ed7.alma.1 |
postgresql-pltcl AlmaLinux:8 | All versions | 12.18-1.module_el8.9.0+3740+0e74851f.alma.1 |
postgresql-pltcl AlmaLinux:8 | All versions | 13.14-1.module_el8.9.0+3738+d55e2165.alma.1 |
Products include Postgresql Postgresql.
How do I fix CVE-2024-0985?
Upgrade postgresql to a fixed version for your release line: 12.18.0, 13.14.0, 14.11.0 or 15.6.0.
Is CVE-2024-0985 being exploited?
There is no known exploitation of CVE-2024-0985 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as ALPINE-CVE-2024-0985, ALSA-2024:0950, ALSA-2024:0951, ALSA-2024:0956, ALSA-2024:0973, ALSA-2024:0974 and 62 more.