CVE-2024-0985

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-0985
Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://lists.debian.org/debian-lts-announce/2024/03/msg00017.html
https://saites.dev/projects/personal/postgres-cve-2024-0985/
https://www.postgresql.org/support/security/CVE-2024-0985/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
History

10 Jul 2024, 18:15

Type Values Removed Values Added
References
  • () https://saites.dev/projects/personal/postgres-cve-2024-0985/ -

20 Jun 2024, 00:15

Type Values Removed Values Added
Summary (en) Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. As part of exploiting this vulnerability, the attacker creates functions that use CREATE RULE to convert the internally-built temporary table to a view. Versions before PostgreSQL 15.6, 14.11, 13.14, and 12.18 are affected. The only known exploit does not work in PostgreSQL 16 and later. For defense in depth, PostgreSQL 16.2 adds the protections that older branches are using to fix their vulnerability. (en) Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.

18 Mar 2024, 17:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/03/msg00017.html -

15 Feb 2024, 15:23

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.0
CWE NVD-CWE-noinfo
References () https://www.postgresql.org/support/security/CVE-2024-0985/ - () https://www.postgresql.org/support/security/CVE-2024-0985/ - Vendor Advisory
First Time Postgresql
Postgresql postgresql
CPE cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

08 Feb 2024, 13:44

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-08 13:15

Updated : 2024-07-10 18:15

NVD link : CVE-2024-0985

Mitre link : CVE-2024-0985

CVE.ORG link : CVE-2024-0985

JSON object : View

Products Affected

postgresql

  • postgresql
CWE
NVD-CWE-noinfo CWE-271

Privilege Dropping / Lowering Errors