Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.
CVSS Details
- CVSS 3.1 Base Score: 8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-serverUpgrade postgresql-private-develUpgrade postgresqlUpgrade postgresql-testUpgrade pg_repackUpgrade pgauditUpgrade postgresql-plpython3Upgrade postgres-decoderbufsUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-private-libsUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macros | Feb 29, 2024 | Feb 8, 2024 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresql13Upgrade postgresql16Upgrade postgresql12 | Mar 26, 2024 | Feb 8, 2024 |
| Amazon Linux Ami 2 | — | Upgrade libpq-develUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-private-develUpgrade postgresql-private-libsUpgrade libpqUpgrade postgresql-plpython2Upgrade postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade postgresql-serverUpgrade postgresql-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade libpq-debuginfoUpgrade postgresql-llvmjitUpgrade postgresql-plperlUpgrade postgresql-plpython3 | Mar 6, 2024 | Feb 8, 2024 |
| Amazon_linux_2023 | — | Upgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-server-develUpgrade postgresql15-plpython3Upgrade postgresql15-contrib-debuginfoUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql15-docsUpgrade postgresql15-llvmjitUpgrade postgresql15-serverUpgrade postgresql15-test-debuginfoUpgrade postgresql15-upgrade-develUpgrade postgresql15-private-develUpgrade postgresql15-debuginfoUpgrade postgresql15-contribUpgrade postgresql15-testUpgrade postgresql15-pltclUpgrade postgresql15-staticUpgrade postgresql15-server-debuginfoUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-debugsourceUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15Upgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-plperlUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-private-libs | Feb 17, 2025 | Feb 8, 2024 |
| Debian | — | Upgrade postgresql-15Upgrade postgresql-13 | Feb 23, 2024 | Feb 8, 2024 |
| Dell Powerstore Dsa2024398 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 17, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Dell Powerstore Dsa2024432 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 29, 2024 |
| Freebsd | — | Upgrade postgresql-server | Feb 9, 2024 | Feb 8, 2024 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 8, 2024 | Feb 8, 2024 |
| Oracle_linux | — | Upgrade postgresql-docsUpgrade postgresql-private-libsUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-plpython3Upgrade postgresql-staticUpgrade postgresql-plperlUpgrade pg_repackUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgres-decoderbufsUpgrade postgresql-private-develUpgrade postgresql-pltclUpgrade pgauditUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-upgrade-devel | Feb 23, 2024 | Feb 8, 2024 |
| Postgres | — | Upgrade to PostgreSQL version 16.2Upgrade to PostgreSQL version 14.11Upgrade to PostgreSQL version 15.6 | Feb 9, 2024 | Feb 8, 2024 |
| Redhat_linux | — | Upgrade postgresql-serverUpgrade postgresql-testNo solution existsUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-plperlUpgrade postgresql-staticUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-server-debuginfoUpgrade pg_repackUpgrade postgres-decoderbufsUpgrade pgaudit-debugsourceUpgrade pg_repack-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-upgradeUpgrade pg_repack-debugsourceUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-debuginfoUpgrade pgauditUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-server-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperl-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-private-develUpgrade pgaudit-debuginfo | Feb 23, 2024 | Feb 8, 2024 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade postgresql-debugsourceUpgrade postgresql-testUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plpython3Upgrade postgresql-plperl-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade postgresql-contrib-debuginfoUpgrade postgresql-serverUpgrade postgresql-docs-debuginfoUpgrade postgresqlUpgrade pg_repack-debugsourceUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-develUpgrade pg_repack-debuginfoUpgrade postgresql-staticUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-private-develUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-contribUpgrade postgresql-private-libsUpgrade postgresql-server-develUpgrade postgresql-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade pgaudit-debuginfoUpgrade pg_repackUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgauditUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgres-decoderbufs | Mar 13, 2024 | Feb 8, 2024 |
| Suse | — | Upgrade postgresql16-develUpgrade postgresql17-plpythonUpgrade postgresql12-server-develUpgrade postgresql13-pltclUpgrade postgresql17-serverUpgrade postgresql14-server-develUpgrade postgresql16-pltclUpgrade postgresql12-develUpgrade postgresql15-contribUpgrade postgresql15-pltclUpgrade postgresql13-server-develUpgrade postgresql14-llvmjit-develUpgrade libecpg6Upgrade postgresql14-pltclUpgrade postgresql16-contribUpgrade postgresql12-plpythonUpgrade postgresql15-docsUpgrade postgresql14-testUpgrade postgresql15-server-develUpgrade postgresql12-llvmjit-develUpgrade postgresql15-develUpgrade postgresql13-llvmjitUpgrade postgresql12-plperlUpgrade postgresql12-pltclUpgrade postgresql15-plperlUpgrade postgresql12-testUpgrade postgresql15-serverUpgrade postgresql16-server-develUpgrade postgresql15-testUpgrade postgresql13-llvmjit-develUpgrade postgresql14-docsUpgrade postgresql16-llvmjit-develUpgrade postgresql16-serverUpgrade postgresql13-contribUpgrade postgresql17-docsUpgrade postgresql12-serverUpgrade postgresql12-docsUpgrade postgresql12-contribUpgrade libpq5Upgrade postgresql17-llvmjitUpgrade postgresql15Upgrade postgresql17-develUpgrade postgresql13-develUpgrade postgresql14Upgrade postgresql13-serverUpgrade postgresql17Upgrade postgresql14-plpythonUpgrade postgresql17-pltclUpgrade postgresql13-docsUpgrade postgresql17-server-develUpgrade postgresql15-llvmjitUpgrade postgresql14-serverUpgrade postgresql12-llvmjitUpgrade postgresql15-llvmjit-develUpgrade postgresql13-plperlUpgrade postgresql16-docsUpgrade postgresql14-llvmjitUpgrade postgresql16-plperlUpgrade postgresql17-plperlUpgrade postgresql13-plpythonUpgrade postgresql15-plpythonUpgrade postgresql17-contribUpgrade postgresql16-llvmjitUpgrade postgresql16-devel-miniUpgrade postgresql16Upgrade postgresql14-develUpgrade postgresql16-testUpgrade postgresql16-plpythonUpgrade postgresql13-testUpgrade postgresql12Upgrade postgresql13Upgrade libecpg6-32bitUpgrade libpq5-32bitUpgrade postgresql14-contribUpgrade postgresql14-plperl | Feb 19, 2024 | Feb 8, 2024 |
| Ubuntu | — | Upgrade postgresql-9.5 (Ubuntu Pro)Upgrade postgresql-client-14Upgrade postgresql-client-12Upgrade postgresql-15Upgrade postgresql-14Upgrade postgresql-client-15Upgrade postgresql-client-9.5 (Ubuntu Pro)Upgrade postgresql-12 | Feb 27, 2024 | Feb 8, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 8, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub