Important: postgresql:15 security update
Summary
ALSA-2024:0973: Important: postgresql:15 security update. Affects pg_repack versions < 1.4.8-1.module_el8.8.0+3487+43ec1b9f. Fixed in 1.4.8-1.module_el8.8.0+3487+43ec1b9f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) that provides robust data storage and retrieval capabilities. It is widely used in various applications and industries for managing large volumes of structured data. PostgreSQL offers a range of features, including support for complex queries, data integrity, and transaction management. However, like any software, it is susceptible to security vulnerabilities that can potentially compromise the confidentiality, integrity, and availability of the data stored in the database.
Vulnerability Detail
The vulnerability identified as CVE-2024-0985 affects PostgreSQL version 15. It allows non-owners to execute arbitrary SQL statements using the 'REFRESH MATERIALIZED VIEW CONCURRENTLY' command. This can lead to unauthorized access, data manipulation, and potential privilege escalation. The vulnerability has been classified as important, indicating a significant risk to the security of PostgreSQL installations.
How To Fix
Minimum fixed version
1.4.8-1.module_el8.8.0+3487+43ec1b9f
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update PostgreSQL to the fixed version as soon as possible.
Conclusion
The identified vulnerability in PostgreSQL version 15 poses a significant security risk, allowing non-owners to execute arbitrary SQL statements. To mitigate this risk, it is crucial to update PostgreSQL to the fixed version as soon as possible. Failure to do so may result in unauthorized access, data manipulation, and potential privilege escalation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pg_repack →
FAQ
PostgreSQL is an advanced object-relational database management system (DBMS) that provides robust data storage and retrieval capabilities.
The vulnerability allows non-owners to execute arbitrary SQL statements, potentially leading to unauthorized access, data manipulation, and privilege escalation.
To fix this vulnerability, update PostgreSQL to version 15.6-1.module_el8.9.0+3739+514705ed.alma.1 or later.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
You can find more information about this vulnerability in the CVE page listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
