Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresqlUpgrade pg_repackUpgrade pgauditUpgrade postgresql-serverUpgrade postgresql-private-libsUpgrade postgresql-private-develUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-testUpgrade postgres-decoderbufsUpgrade postgresql-plperlUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-contrib | Feb 29, 2024 | Feb 8, 2024 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql14Upgrade postgresql13Upgrade postgresql16Upgrade postgresql12 | Mar 26, 2024 | Feb 8, 2024 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-plpython2Upgrade libpq-debuginfoUpgrade postgresql-llvmjitUpgrade postgresql-debuginfoUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-contribUpgrade libpq-develUpgrade libpqUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-private-libsUpgrade postgresql-upgrade-develUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-private-devel | Mar 6, 2024 | Feb 8, 2024 |
| Amazon_linux_2023 | — | Upgrade postgresql15-contrib-debuginfoUpgrade postgresql15-docsUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-server-develUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql15-llvmjitUpgrade postgresql15-plpython3Upgrade postgresql15-serverUpgrade postgresql15-test-debuginfoUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-private-libsUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-debuginfoUpgrade postgresql15-contribUpgrade postgresql15-testUpgrade postgresql15-pltclUpgrade postgresql15-private-develUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-plperlUpgrade postgresql15-staticUpgrade postgresql15-upgrade-develUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-debugsourceUpgrade postgresql15Upgrade postgresql15-server-debuginfoUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-test-rpm-macros | Feb 17, 2025 | Feb 8, 2024 |
| Debian | — | Upgrade postgresql-13Upgrade postgresql-15 | Feb 23, 2024 | Feb 8, 2024 |
| Dell Powerstore Dsa2024398 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 17, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Dell Powerstore Dsa2024432 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 29, 2024 |
| Freebsd | — | Upgrade postgresql-server | Feb 9, 2024 | Feb 8, 2024 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 8, 2024 | Feb 8, 2024 |
| Oracle_linux | — | Upgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-serverUpgrade pg_repackUpgrade postgresql-docsUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-staticUpgrade postgresql-private-libsUpgrade postgresql-server-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade pgauditUpgrade postgres-decoderbufsUpgrade postgresql-private-develUpgrade postgresql-pltcl | Feb 23, 2024 | Feb 8, 2024 |
| Postgres | — | Upgrade to PostgreSQL version 16.2Upgrade to PostgreSQL version 12.18Upgrade to PostgreSQL version 14.11Upgrade to PostgreSQL version 13.14Upgrade to PostgreSQL version 15.6 | Feb 9, 2024 | Feb 8, 2024 |
| Redhat_linux | — | Upgrade postgresql-upgrade-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-plperlUpgrade postgresql-debugsourceUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-testNo solution existsUpgrade postgresql-serverUpgrade postgresql-test-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-server-develUpgrade pgaudit-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade pg_repackUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-private-develUpgrade pgaudit-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgresql-upgradeUpgrade postgresql-private-libsUpgrade pg_repack-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-private-libs-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-plpython3Upgrade postgres-decoderbufs-debuginfoUpgrade postgresql-debuginfo | Feb 23, 2024 | Feb 8, 2024 |
| Rocky_linux | — | Upgrade postgresqlUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-pltclUpgrade postgresql-contrib-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-testUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade pgaudit-debugsourceUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-server-develUpgrade postgresql-staticUpgrade pg_repack-debugsourceUpgrade pg_repack-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-server-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-private-develUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade pgaudit-debuginfoUpgrade pg_repackUpgrade postgresql-contribUpgrade pgauditUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgres-decoderbufs | Mar 13, 2024 | Feb 8, 2024 |
| Suse | — | Upgrade postgresql13-plpythonUpgrade postgresql16-devel-miniUpgrade postgresql16Upgrade postgresql14-llvmjitUpgrade postgresql15-plpythonUpgrade postgresql14-develUpgrade postgresql13-testUpgrade postgresql17-plperlUpgrade postgresql16-plperlUpgrade postgresql13-serverUpgrade postgresql12-docsUpgrade postgresql13Upgrade postgresql14Upgrade libpq5Upgrade libpq5-32bitUpgrade postgresql17-develUpgrade postgresql17-llvmjitUpgrade postgresql17-pltclUpgrade postgresql16-docsUpgrade postgresql14-plpythonUpgrade postgresql13-develUpgrade postgresql15-llvmjit-develUpgrade postgresql14-plperlUpgrade postgresql15Upgrade postgresql14-contribUpgrade postgresql15-llvmjitUpgrade libecpg6-32bitUpgrade postgresql16-testUpgrade postgresql12-llvmjitUpgrade postgresql12Upgrade postgresql17-contribUpgrade postgresql16-plpythonUpgrade postgresql14-serverUpgrade postgresql17Upgrade postgresql12-contribUpgrade postgresql16-llvmjitUpgrade postgresql13-plperlUpgrade postgresql17-server-develUpgrade postgresql12-serverUpgrade postgresql13-docsUpgrade postgresql12-llvmjit-develUpgrade postgresql17-serverUpgrade postgresql17-plpythonUpgrade postgresql17-docsUpgrade postgresql14-testUpgrade postgresql14-llvmjit-develUpgrade libecpg6Upgrade postgresql13-server-develUpgrade postgresql16-serverUpgrade postgresql16-pltclUpgrade postgresql15-testUpgrade postgresql15-serverUpgrade postgresql15-contribUpgrade postgresql14-server-develUpgrade postgresql13-pltclUpgrade postgresql12-develUpgrade postgresql15-plperlUpgrade postgresql16-contribUpgrade postgresql13-llvmjitUpgrade postgresql12-testUpgrade postgresql12-plpythonUpgrade postgresql14-docsUpgrade postgresql13-llvmjit-develUpgrade postgresql16-llvmjit-develUpgrade postgresql15-pltclUpgrade postgresql13-contribUpgrade postgresql14-pltclUpgrade postgresql15-docsUpgrade postgresql16-develUpgrade postgresql16-server-develUpgrade postgresql12-server-develUpgrade postgresql15-server-develUpgrade postgresql15-develUpgrade postgresql12-pltclUpgrade postgresql12-plperl | Feb 19, 2024 | Feb 8, 2024 |
| Ubuntu | — | Upgrade postgresql-12Upgrade postgresql-14Upgrade postgresql-client-15Upgrade postgresql-client-9.5 (Ubuntu Pro)Upgrade postgresql-9.5 (Ubuntu Pro)Upgrade postgresql-client-12Upgrade postgresql-client-14Upgrade postgresql-15 | Feb 27, 2024 | Feb 8, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 8, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub