Read the docs
TI-2024-00908 Aliases CVE-2024-0985GHSA-4828-5p9m-g4ff

PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL

Priority MEDIUM 40CWE-271Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 17 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01808 78th percentileScored 2026-11-07
Fix Partial PostgreSQL: 16.2, 15.6, 14.11 +2Red Hat: 24 advisoriesRed Hat: 17 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—PostgreSQL16 to before 16.2; 15 to before 15.6; 14 to before 14.11; 13 to before 13.14; before 12.1816.2, 15.6, 14.11, 13.14, 12.18Patch availableCNA
  • PostgreSQL Vendor— Affected 16 to before 16.2; 15 to before 15.6; 14 to before 14.11; 13 to before 13.14; before 12.18 Fixed in 16.2, 15.6, 14.11, 13.14, 12.18 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*12.0 to before 12.18; 13.0 to before 13.14; 14.0 to before 14.11; 15.0 to before 15.6VulnerablePostgreSQL
  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions 12.0 to before 12.18; 13.0 to before 13.14; 14.0 to before 14.11; 15.0 to before 15.6 Vulnerable ·PostgreSQL

Remediation

  • Fix · CNA PostgreSQL Fixed in 16.2, 15.6, 14.11, 13.14, 12.18

Red Hat 24 advisories

  • RHSA-2024:1437 Released 2024-03-20 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.ppc64le::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13 +29
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
  • RHSA-2024:1428 Released 2024-03-19 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) postgresql-10.23-4.module+el8.8.0+21372+7f1ca650.aarch64::postgresql:10, postgresql-10.23-4.module+el8.8.0+21372+7f1ca650.ppc64le::postgresql:10, postgresql-10.23-4.module+el8.8.0+21372+7f1ca650.s390x::postgresql:10 +47
  • RHSA-2024:1426 Released 2024-03-19 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13 +47
Show 21 more Red Hat advisories
  • RHSA-2024:1429 Released 2024-03-19 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) postgresql-10.21-4.module+el8.4.0+21369+5e83297f.src::postgresql:10, postgresql-10.21-4.module+el8.4.0+21369+5e83297f.x86_64::postgresql:10, postgresql-contrib-10.21-4.module+el8.4.0+21369+5e83297f.x86_64::postgresql:10 +11
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) postgresql-10.21-4.module+el8.4.0+21369+5e83297f.ppc64le::postgresql:10, postgresql-10.21-4.module+el8.4.0+21369+5e83297f.src::postgresql:10, postgresql-10.21-4.module+el8.4.0+21369+5e83297f.x86_64::postgresql:10 +24
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) postgresql-10.21-4.module+el8.4.0+21369+5e83297f.src::postgresql:10, postgresql-10.21-4.module+el8.4.0+21369+5e83297f.x86_64::postgresql:10, postgresql-contrib-10.21-4.module+el8.4.0+21369+5e83297f.x86_64::postgresql:10 +11
  • RHSA-2024:1422 Released 2024-03-19 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) postgresql-10.21-4.module+el8.2.0+21384+f73fb27d.src::postgresql:10, postgresql-10.21-4.module+el8.2.0+21384+f73fb27d.x86_64::postgresql:10, postgresql-contrib-10.21-4.module+el8.2.0+21384+f73fb27d.x86_64::postgresql:10 +11
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) postgresql-10.21-4.module+el8.2.0+21384+f73fb27d.ppc64le::postgresql:10, postgresql-10.21-4.module+el8.2.0+21384+f73fb27d.src::postgresql:10, postgresql-10.21-4.module+el8.2.0+21384+f73fb27d.x86_64::postgresql:10 +24
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) postgresql-10.21-4.module+el8.2.0+21384+f73fb27d.src::postgresql:10, postgresql-10.21-4.module+el8.2.0+21384+f73fb27d.x86_64::postgresql:10, postgresql-contrib-10.21-4.module+el8.2.0+21384+f73fb27d.x86_64::postgresql:10 +11
  • RHSA-2024:1348 Released 2024-03-18 · Red Hat rating Important
    postgresql:10 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) postgresql-10.21-4.module+el8.6.0+21345+167dd12c.aarch64::postgresql:10, postgresql-10.21-4.module+el8.6.0+21345+167dd12c.ppc64le::postgresql:10, postgresql-10.21-4.module+el8.6.0+21345+167dd12c.s390x::postgresql:10 +47
  • RHSA-2024:1315 Released 2024-03-13 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13 +47
  • RHSA-2024:1314 Released 2024-03-13 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47
  • RHSA-2024:1241 Released 2024-03-11 · Red Hat rating Important
    postgresql security update
    • Red Hat CodeReady Linux Builder EUS (v.9.2) postgresql-docs-13.14-1.el9_2, postgresql-private-devel-13.14-1.el9_2, postgresql-server-devel-13.14-1.el9_2 +3
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) postgresql-13.14-1.el9_2, postgresql-contrib-13.14-1.el9_2, postgresql-plperl-13.14-1.el9_2 +5
  • RHSA-2024:1240 Released 2024-03-11 · Red Hat rating Important
    postgresql security update
    • Red Hat CodeReady Linux Builder EUS (v.9.0) postgresql-private-devel-13.14-1.el9_0, postgresql-server-devel-13.14-1.el9_0, postgresql-test-13.14-1.el9_0
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) postgresql-13.14-1.el9_0, postgresql-contrib-13.14-1.el9_0, postgresql-plperl-13.14-1.el9_0 +5
  • RHSA-2024:1195 Released 2024-03-06 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.src::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.4.0+11288+c193d6d7.src::postgresql:12 +15
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.ppc64le::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.src::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.x86_64::postgresql:12 +29
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.src::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.4.0+11288+c193d6d7.src::postgresql:12 +15
  • RHSA-2024:1070 Released 2024-03-04 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.aarch64::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.s390x::postgresql:12 +47
  • RHSA-2024:1069 Released 2024-03-04 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.aarch64::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.s390x::postgresql:12 +47
  • RHSA-2024:1071 Released 2024-03-04 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.src::postgresql:12, pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.2.0+9043+1dbb5661.src::postgresql:12 +15
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.ppc64le::postgresql:12, pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.src::postgresql:12, pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.x86_64::postgresql:12 +29
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.src::postgresql:12, pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.2.0+9043+1dbb5661.src::postgresql:12 +15
  • RHSA-2024:1017 Released 2024-02-28 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.s390x::postgresql:15 +47
  • RHSA-2024:0990 Released 2024-02-26 · Red Hat rating Important
    rh-postgresql12-postgresql security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-postgresql12-postgresql-12.18-1.el7, rh-postgresql12-postgresql-contrib-12.18-1.el7, rh-postgresql12-postgresql-contrib-syspaths-12.18-1.el7 +11
    • Red Hat Software Collections for RHEL(v. 7) rh-postgresql12-postgresql-12.18-1.el7, rh-postgresql12-postgresql-contrib-12.18-1.el7, rh-postgresql12-postgresql-contrib-syspaths-12.18-1.el7 +11
  • RHSA-2024:0988 Released 2024-02-26 · Red Hat rating Important
    rh-postgresql13-postgresql security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-postgresql13-postgresql-13.14-1.el7, rh-postgresql13-postgresql-contrib-13.14-1.el7, rh-postgresql13-postgresql-contrib-syspaths-13.14-1.el7 +12
    • Red Hat Software Collections for RHEL(v. 7) rh-postgresql13-postgresql-13.14-1.el7, rh-postgresql13-postgresql-contrib-13.14-1.el7, rh-postgresql13-postgresql-contrib-syspaths-13.14-1.el7 +12
  • RHSA-2024:0992 Released 2024-02-26 · Red Hat rating Important
    rh-postgresql10-postgresql security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-postgresql10-postgresql-10.23-3.el7, rh-postgresql10-postgresql-contrib-10.23-3.el7, rh-postgresql10-postgresql-contrib-syspaths-10.23-3.el7 +11
    • Red Hat Software Collections for RHEL(v. 7) rh-postgresql10-postgresql-10.23-3.el7, rh-postgresql10-postgresql-contrib-10.23-3.el7, rh-postgresql10-postgresql-contrib-syspaths-10.23-3.el7 +11
  • RHSA-2024:0975 Released 2024-02-26 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.s390x::postgresql:13 +47
  • RHSA-2024:0974 Released 2024-02-26 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.aarch64::postgresql:12, pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.s390x::postgresql:12 +47
  • RHSA-2024:0973 Released 2024-02-26 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.s390x::postgresql:15 +47
  • RHSA-2024:0956 Released 2024-02-26 · Red Hat rating Important
    postgresql:10 security update
    • Red Hat Enterprise Linux AppStream (v. 8) postgresql-10.23-4.module+el8.9.0+21317+d2c6bf8a.aarch64::postgresql:10, postgresql-10.23-4.module+el8.9.0+21317+d2c6bf8a.ppc64le::postgresql:10, postgresql-10.23-4.module+el8.9.0+21317+d2c6bf8a.s390x::postgresql:10 +47
  • RHSA-2024:0951 Released 2024-02-22 · Red Hat rating Important
    postgresql security update
    • Red Hat CodeReady Linux Builder (v. 9) postgresql-docs-13.14-1.el9_3, postgresql-private-devel-13.14-1.el9_3, postgresql-server-devel-13.14-1.el9_3 +3
    • Red Hat Enterprise Linux AppStream (v. 9) postgresql-13.14-1.el9_3, postgresql-contrib-13.14-1.el9_3, postgresql-plperl-13.14-1.el9_3 +5
  • RHSA-2024:0950 Released 2024-02-22 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat CodeReady Linux Builder (v. 9)Fixed RHSA-2024:0951
Red Hat CodeReady Linux Builder EUS (v.9.0)Fixed RHSA-2024:1240
Red Hat CodeReady Linux Builder EUS (v.9.2)Fixed RHSA-2024:1241
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:0956, RHSA-2024:0973, RHSA-2024:0974, RHSA-2024:0975
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:0950, RHSA-2024:0951
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2024:1071, RHSA-2024:1422
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:1195, RHSA-2024:1429, RHSA-2024:1437
Red Hat Enterprise Linux AppStream E4S (v. 8.2)Fixed RHSA-2024:1071, RHSA-2024:1422
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:1195, RHSA-2024:1429, RHSA-2024:1437
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2024:1070, RHSA-2024:1315, RHSA-2024:1348
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:1017, RHSA-2024:1069, RHSA-2024:1426, RHSA-2024:1428
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2024:1240
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:1241, RHSA-2024:1314
Red Hat Enterprise Linux AppStream TUS (v. 8.2)Fixed RHSA-2024:1071, RHSA-2024:1422
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:1195, RHSA-2024:1429, RHSA-2024:1437
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2024:0988, RHSA-2024:0990, RHSA-2024:0992
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2024:0988, RHSA-2024:0990, RHSA-2024:0992
Not affected: 10 products
  • OpenShift Serverless
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat JBoss Data Grid 7
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Debezium 2
  • Red Hat build of OptaPlanner 8

Microsoft

Microsoft's page for this CVE →

Impact
—
Exploited
—
Publicly disclosed
—
Exploitability
—
ProductStatusPlan or fix
Azure Linux 3.0 ARMFixed 16.3-1 · CBL-Mariner
Azure Linux 3.0 x64Fixed 16.3-1 · CBL-Mariner
CBL Mariner 2.0 ARMFixed 14.11-1 · CBL-Mariner
CBL Mariner 2.0 x64Fixed 14.11-1 · CBL-Mariner

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-0985
  2. 2026-10-03 Alias added: GHSA-4828-5p9m-g4ff

References

Advisory 1

Other 2

  • TI-2019-06651 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and… CVSS 3.0HIGH 7.2
  • TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
  • TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8
  • TI-2013-01675 Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9… CVSS 2.0MEDIUM 6.5
  • TI-2007-03176 The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE… CVSS 2.0HIGH 9.0
  • TI-2022-01423 SQL injection in postgresql CVSS 3.1HIGH 8.8
See all 202 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences