Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-plperlUpgrade postgresql-private-libsUpgrade postgresql-serverUpgrade pg_repackUpgrade postgresql-docsUpgrade postgresql-private-develUpgrade postgresqlUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade postgres-decoderbufsUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade pgauditUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-static | Aug 30, 2024 | May 14, 2024 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-debuginfoUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgresql-plperlUpgrade postgresql-llvmjitUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-test-rpm-macros | Jun 12, 2024 | May 14, 2024 |
| Amazon_linux_2023 | — | Upgrade postgresql15-upgrade-develUpgrade postgresql15-debugsourceUpgrade postgresql15-debuginfoUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-plperlUpgrade postgresql15-plpython3Upgrade postgresql15-docs-debuginfoUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-serverUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-pltclUpgrade postgresql15-server-debuginfoUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-test-debuginfoUpgrade postgresql15-testUpgrade postgresql15-contribUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-staticUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql15-server-develUpgrade postgresql15-private-libsUpgrade postgresql15-llvmjitUpgrade postgresql15Upgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-private-develUpgrade postgresql15-docs | Feb 17, 2025 | May 9, 2024 |
| Debian | — | Upgrade postgresql-15 | Oct 28, 2024 | May 14, 2024 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | May 9, 2024 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 8, 2024 | May 14, 2024 |
| Oracle_linux | — | Upgrade postgres-decoderbufsUpgrade postgresqlUpgrade pgauditUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-private-develUpgrade postgresql-testUpgrade postgresql-test-rpm-macrosUpgrade pg_repackUpgrade postgresql-serverUpgrade postgresql-staticUpgrade postgresql-server-develUpgrade postgresql-upgrade-develUpgrade postgresql-private-libsUpgrade postgresql-upgradeUpgrade postgresql-plpython3 | Oct 16, 2024 | May 9, 2024 |
| Postgres | — | Upgrade to PostgreSQL version 14.12Upgrade to PostgreSQL version 15.7Upgrade to PostgreSQL version 16.3 | May 13, 2024 | May 9, 2024 |
| Redhat_linux | — | Upgrade postgresql-pltclUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-staticUpgrade postgresql-docs-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-plpython3Upgrade postgresql-plperlUpgrade pg_repackUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-testNo solution existsUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-server-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-private-develUpgrade pgauditUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade postgresql-private-libs-debuginfoUpgrade pgaudit-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade pg_repack-debugsourceUpgrade postgresql-debuginfo | Sep 13, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-serverUpgrade postgresql-upgradeUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-staticUpgrade postgresql-plpython3Upgrade postgresql-private-libsUpgrade postgresql-docsUpgrade postgresql-test-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-private-develUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debuginfoUpgrade pgauditUpgrade postgresql-plperl-debuginfoUpgrade postgresql-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufsUpgrade pg_repack-debuginfoUpgrade pg_repackUpgrade pgaudit-debugsourceUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresql-contrib | Sep 17, 2024 | May 14, 2024 |
| Suse | — | Upgrade postgresql15-contribUpgrade postgresql15-llvmjitUpgrade libecpg6-32bitUpgrade postgresql14-plperlUpgrade postgresql16-devel-miniUpgrade libpq5Upgrade libpq5-32bitUpgrade postgresql14-llvmjitUpgrade postgresql16-contribUpgrade postgresql14-contribUpgrade postgresql15-plpythonUpgrade postgresql16-docsUpgrade postgresql14-plpythonUpgrade postgresql16-serverUpgrade postgresql16-testUpgrade postgresql16-plperlUpgrade postgresql15-llvmjit-develUpgrade postgresql14-llvmjit-develUpgrade postgresql15-pltclUpgrade postgresql15Upgrade postgresql16-llvmjit-develUpgrade postgresql14-develUpgrade postgresql14-docsUpgrade postgresql15-docsUpgrade libecpg6Upgrade postgresql15-server-develUpgrade postgresql14-pltclUpgrade postgresql15-develUpgrade postgresql16-llvmjitUpgrade postgresql16-pltclUpgrade postgresql16Upgrade postgresql14-testUpgrade postgresql15-plperlUpgrade postgresql14Upgrade postgresql16-server-develUpgrade postgresql15-testUpgrade postgresql15-serverUpgrade postgresql16-develUpgrade postgresql16-plpythonUpgrade postgresql14-server-develUpgrade postgresql14-server | May 16, 2024 | May 14, 2024 |
| Ubuntu | — | Upgrade postgresql-client-16Upgrade postgresql-16Upgrade postgresql-14Upgrade postgresql-client-15Upgrade postgresql-15Upgrade postgresql-client-14 | Jun 6, 2024 | May 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 9, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub