Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.
CVSS Details
- CVSS 3.1 Base Score: 8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-upgrade-develUpgrade postgresql-staticUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-server-develUpgrade postgresql-private-libsUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-private-develUpgrade pg_repackUpgrade postgresql-plpython3Upgrade pgauditUpgrade postgresql-testUpgrade postgres-decoderbufsUpgrade postgresql-server | Feb 29, 2024 | Feb 8, 2024 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql14Upgrade postgresql12Upgrade postgresql13Upgrade postgresql16 | Mar 26, 2024 | Feb 8, 2024 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade libpq-debuginfoUpgrade postgresql-llvmjitUpgrade postgresql-serverUpgrade postgresql-debuginfoUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-plpython2Upgrade postgresql-plpython3Upgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-staticUpgrade postgresql-private-develUpgrade postgresqlUpgrade postgresql-upgrade-develUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-private-libsUpgrade libpqUpgrade libpq-devel | Mar 6, 2024 | Feb 8, 2024 |
| Amazon_linux_2023 | — | Upgrade postgresql15-llvmjitUpgrade postgresql15-test-debuginfoUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-plpython3Upgrade postgresql15-serverUpgrade postgresql15-upgradeUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-server-develUpgrade postgresql15-docsUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-upgrade-develUpgrade postgresql15-contribUpgrade postgresql15-testUpgrade postgresql15-private-libsUpgrade postgresql15-private-develUpgrade postgresql15-pltclUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-plperlUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql15Upgrade postgresql15-plperl-debuginfoUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-staticUpgrade postgresql15-debugsource | Feb 17, 2025 | Feb 8, 2024 |
| Debian | — | Upgrade postgresql-13Upgrade postgresql-15 | Feb 23, 2024 | Feb 8, 2024 |
| Dell Powerstore Dsa2024398 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 17, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Dell Powerstore Dsa2024432 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 29, 2024 |
| Freebsd | — | Upgrade postgresql-server | Feb 9, 2024 | Feb 8, 2024 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 8, 2024 | Feb 8, 2024 |
| Oracle_linux | — | Upgrade postgres-decoderbufsUpgrade postgresql-private-develUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-server-develUpgrade postgresql-upgrade-develUpgrade postgresql-test-rpm-macrosUpgrade pgauditUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-private-libsUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-plpython3Upgrade postgresql-staticUpgrade postgresql-upgradeUpgrade pg_repackUpgrade postgresql-plperl | Feb 23, 2024 | Feb 8, 2024 |
| Postgres | — | Upgrade to PostgreSQL version 15.6Upgrade to PostgreSQL version 14.11Upgrade to PostgreSQL version 16.2 | Feb 9, 2024 | Feb 8, 2024 |
| Redhat_linux | — | Upgrade postgresql-debuginfoUpgrade pgauditUpgrade postgresql-server-devel-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-plpython3Upgrade pgaudit-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgrade-develUpgrade pg_repack-debuginfoUpgrade postgresql-private-develUpgrade postgresql-test-rpm-macrosUpgrade pg_repackUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-develUpgrade postgres-decoderbufsUpgrade postgresql-upgradeUpgrade postgresql-upgrade-devel-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-plperl-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-debuginfoNo solution existsUpgrade postgresql-staticUpgrade postgresql-test-debuginfoUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-plpython3-debuginfoUpgrade postgresqlUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-contrib-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-pltcl-debuginfo | Feb 23, 2024 | Feb 8, 2024 |
| Rocky_linux | — | Upgrade postgresqlUpgrade postgresql-test-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-debugsourceUpgrade postgresql-testUpgrade postgresql-contrib-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-private-develUpgrade pg_repack-debugsourceUpgrade postgresql-private-libsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-contribUpgrade pgaudit-debuginfoUpgrade pg_repackUpgrade postgresql-private-libs-debuginfoUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-server-develUpgrade pg_repack-debuginfo | Mar 13, 2024 | Feb 8, 2024 |
| Suse | — | Upgrade libpq5-32bitUpgrade postgresql14-contribUpgrade postgresql16-docsUpgrade postgresql14-plperlUpgrade postgresql13-develUpgrade postgresql12-contribUpgrade postgresql15Upgrade postgresql17-llvmjitUpgrade postgresql17-pltclUpgrade libpq5Upgrade postgresql17-develUpgrade libecpg6-32bitUpgrade postgresql14-llvmjitUpgrade postgresql14-plpythonUpgrade postgresql16-testUpgrade postgresql12Upgrade postgresql16-plpythonUpgrade postgresql13-testUpgrade postgresql17-server-develUpgrade postgresql13Upgrade postgresql16-plperlUpgrade postgresql14-develUpgrade postgresql15-llvmjit-develUpgrade postgresql13-plperlUpgrade postgresql12-serverUpgrade postgresql16Upgrade postgresql13-serverUpgrade postgresql12-docsUpgrade postgresql17-plperlUpgrade postgresql15-plpythonUpgrade postgresql16-devel-miniUpgrade postgresql13-plpythonUpgrade postgresql17-contribUpgrade postgresql14Upgrade postgresql12-llvmjitUpgrade postgresql14-serverUpgrade postgresql16-llvmjitUpgrade postgresql15-llvmjitUpgrade postgresql13-docsUpgrade postgresql17Upgrade postgresql16-pltclUpgrade postgresql15-testUpgrade postgresql15-contribUpgrade postgresql14-server-develUpgrade postgresql15-develUpgrade postgresql12-pltclUpgrade postgresql12-plperlUpgrade postgresql15-server-develUpgrade postgresql12-llvmjit-develUpgrade postgresql16-develUpgrade postgresql17-plpythonUpgrade postgresql17-docsUpgrade postgresql17-serverUpgrade postgresql16-contribUpgrade postgresql13-llvmjit-develUpgrade postgresql15-plperlUpgrade postgresql13-llvmjitUpgrade postgresql12-testUpgrade postgresql15-pltclUpgrade postgresql16-llvmjit-develUpgrade postgresql14-docsUpgrade postgresql12-plpythonUpgrade postgresql13-contribUpgrade postgresql15-docsUpgrade libecpg6Upgrade postgresql13-pltclUpgrade postgresql12-develUpgrade postgresql16-serverUpgrade postgresql14-pltclUpgrade postgresql13-server-develUpgrade postgresql14-testUpgrade postgresql14-llvmjit-develUpgrade postgresql15-serverUpgrade postgresql16-server-develUpgrade postgresql12-server-devel | Feb 19, 2024 | Feb 8, 2024 |
| Ubuntu | — | Upgrade postgresql-9.5 (Ubuntu Pro)Upgrade postgresql-15Upgrade postgresql-client-12Upgrade postgresql-client-14Upgrade postgresql-12Upgrade postgresql-client-15Upgrade postgresql-14Upgrade postgresql-client-9.5 (Ubuntu Pro) | Feb 27, 2024 | Feb 8, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 8, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub