Important: postgresql:10 security update
Summary
ALSA-2024:0956: Important: postgresql:10 security update. Affects postgresql versions < 10.23-4.module_el8.9.0+3736+952d0ed7.alma.1. Fixed in 10.23-4.module_el8.9.0+3736+952d0ed7.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) that provides robust data storage and retrieval capabilities. It is widely used in various applications and industries for managing large volumes of structured data. The vulnerability in PostgreSQL version 10 allows non-owner users to execute arbitrary SQL statements using the 'REFRESH MATERIALIZED VIEW CONCURRENTLY' command. This can lead to unauthorized access, data manipulation, and potential security breaches.
Vulnerability Detail
The vulnerability (CVE-2024-0985) in PostgreSQL version 10 allows non-owner users to execute arbitrary SQL statements using the 'REFRESH MATERIALIZED VIEW CONCURRENTLY' command. This means that an attacker with non-owner privileges can manipulate the database and execute unauthorized SQL queries. The impact of this vulnerability can range from unauthorized data access to data manipulation and potential security breaches. It is important to address this vulnerability promptly to ensure the security and integrity of the PostgreSQL database.
How To Fix
Minimum fixed version
10.23-4.module_el8.9.0+3736+952d0ed7.alma.1
This is the first release that contains the fix.
sudo dnf update postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the security update as soon as possible to address the issue.
Conclusion
The vulnerability in PostgreSQL version 10 allows non-owner users to execute arbitrary SQL statements, posing a risk of unauthorized data access and potential security breaches. It is crucial to update PostgreSQL to version 10.23-4.module_el8.9.0+3736+952d0ed7.alma.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql →
FAQ
PostgreSQL is an advanced object-relational database management system (DBMS) that provides robust data storage and retrieval capabilities.
The vulnerability allows non-owner users to execute arbitrary SQL statements, potentially leading to unauthorized data access, data manipulation, and security breaches.
To fix this vulnerability, update PostgreSQL to version 10.23-4.module_el8.9.0+3736+952d0ed7.alma.1 or later.
No, there is no known workaround for this vulnerability. It is important to apply the security update.
For more details about this vulnerability, including the impact, CVSS score, and related information, refer to the CVE page(s) listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
