Important: postgresql:13 security update
Summary
ALSA-2024:0975: Important: postgresql:13 security update. Affects pg_repack across 2 version ranges.
< 1.4.6-3.module_el8.6.0+2760+1746ec94
< 1.4.6-3.module_el8.6.0+3095+ee60d910
Fixed in 1.4.6-3.module_el8.6.0+2760+1746ec94 or 1.4.6-3.module_el8.6.0+3095+ee60d910, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PostgreSQL is an advanced object-relational database management system (DBMS) that provides robust data storage and retrieval capabilities. It is widely used in various applications and industries due to its scalability, performance, and reliability. However, like any software, PostgreSQL is susceptible to security vulnerabilities that can compromise the integrity and confidentiality of data stored in the database.
Vulnerability Detail
The vulnerability identified as CVE-2024-0985 affects PostgreSQL version 13 and allows non-owners to execute arbitrary SQL statements using the 'REFRESH MATERIALIZED VIEW CONCURRENTLY' command. This can lead to unauthorized access, data manipulation, or privilege escalation within the database. The impact of this vulnerability depends on the permissions granted to non-owners and the sensitivity of the data stored in the affected database.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update pg_repack-
< 1.4.6-3.module_el8.6.0+2760+1746ec941.4.6-3.module_el8.6.0+2760+1746ec94 -
< 1.4.6-3.module_el8.6.0+3095+ee60d9101.4.6-3.module_el8.6.0+3095+ee60d910
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible to mitigate the risk of exploitation.
Conclusion
The identified vulnerability in PostgreSQL version 13 allows non-owners to execute arbitrary SQL statements, posing a risk of unauthorized access, data manipulation, or privilege escalation. To mitigate this risk, it is essential to update PostgreSQL to version 13.14-1.module_el8.9.0+3738+d55e2165.alma.1 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pg_repack →
FAQ
PostgreSQL is an advanced object-relational database management system known for its scalability, performance, and reliability. It provides robust data storage and retrieval capabilities and is widely used in various applications and industries.
The vulnerability allows non-owners to execute arbitrary SQL statements, potentially leading to unauthorized access, data manipulation, or privilege escalation within the affected PostgreSQL database.
The vulnerability affects PostgreSQL version 13.
To fix this vulnerability, update PostgreSQL to version 13.14-1.module_el8.9.0+3738+d55e2165.alma.1 or later. Follow the official update process provided by the PostgreSQL community or your operating system's package manager.
No, there is no known workaround for this vulnerability. It is crucial to apply the security update to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
