Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-docsUpgrade pgauditUpgrade postgresql-plperlUpgrade postgresql-staticUpgrade pg_repackUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufsUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-private-develUpgrade postgresql-pltclUpgrade postgresql-private-libsUpgrade postgresql | Aug 30, 2024 | May 14, 2024 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-upgrade-develUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-llvmjitUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-serverUpgrade postgresql-debuginfoUpgrade postgresql-plpython3Upgrade postgresqlUpgrade postgresql-test | Jun 12, 2024 | May 14, 2024 |
| Amazon_linux_2023 | — | Upgrade postgresql15-contrib-debuginfoUpgrade postgresql15-serverUpgrade postgresql15-plpython3Upgrade postgresql15-test-rpm-macrosUpgrade postgresql15-testUpgrade postgresql15-debuginfoUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql15-pltclUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-upgrade-develUpgrade postgresql15-plperlUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-contribUpgrade postgresql15-test-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-debugsourceUpgrade postgresql15-server-develUpgrade postgresql15-llvmjitUpgrade postgresql15-staticUpgrade postgresql15-private-libsUpgrade postgresql15-private-develUpgrade postgresql15-upgradeUpgrade postgresql15Upgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-docsUpgrade postgresql15-plpython3-debuginfo | Feb 17, 2025 | May 9, 2024 |
| Debian | — | Upgrade postgresql-15 | Oct 28, 2024 | May 14, 2024 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | May 9, 2024 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 8, 2024 | May 14, 2024 |
| Oracle_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-serverUpgrade pg_repackUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresqlUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgresql-contribUpgrade postgresql-private-develUpgrade postgresql-testUpgrade postgresql-private-libsUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-upgrade-devel | Oct 16, 2024 | May 9, 2024 |
| Postgres | — | Upgrade to PostgreSQL version 14.12Upgrade to PostgreSQL version 16.3Upgrade to PostgreSQL version 15.7 | May 13, 2024 | May 9, 2024 |
| Redhat_linux | — | Upgrade postgresql-pltclNo solution existsUpgrade postgresql-plperlUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plpython3Upgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-docsUpgrade postgresql-docs-debuginfoUpgrade pg_repackUpgrade postgresql-upgradeUpgrade postgresql-private-libsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-serverUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-server-develUpgrade pgauditUpgrade postgresql-private-develUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufsUpgrade pg_repack-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-develUpgrade pg_repack-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-plperl-debuginfo | Sep 13, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade postgresql-upgradeUpgrade postgresql-staticUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-testUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-private-libsUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-debugsourceUpgrade postgresql-plpython3Upgrade postgresql-pltcl-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-docs-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-private-develUpgrade postgresql-plperl-debuginfoUpgrade pgauditUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-debuginfoUpgrade pg_repack-debugsourceUpgrade pg_repack-debuginfoUpgrade pg_repackUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-server-devel | Sep 17, 2024 | May 14, 2024 |
| Suse | — | Upgrade postgresql16-plpythonUpgrade postgresql14-server-develUpgrade postgresql14-pltclUpgrade libecpg6Upgrade postgresql14Upgrade postgresql14-testUpgrade postgresql15-plperlUpgrade postgresql16-pltclUpgrade postgresql15-testUpgrade postgresql16-develUpgrade postgresql15-develUpgrade postgresql15-serverUpgrade postgresql15-docsUpgrade postgresql14-serverUpgrade postgresql16Upgrade postgresql15-server-develUpgrade postgresql16-llvmjitUpgrade postgresql16-server-develUpgrade postgresql15-plpythonUpgrade libpq5-32bitUpgrade postgresql15-llvmjitUpgrade postgresql14-develUpgrade postgresql15-contribUpgrade postgresql14-plpythonUpgrade postgresql14-llvmjit-develUpgrade libecpg6-32bitUpgrade postgresql16-serverUpgrade postgresql16-llvmjit-develUpgrade postgresql16-docsUpgrade postgresql15-pltclUpgrade postgresql15Upgrade postgresql14-docsUpgrade postgresql16-testUpgrade postgresql16-devel-miniUpgrade libpq5Upgrade postgresql14-plperlUpgrade postgresql14-llvmjitUpgrade postgresql16-plperlUpgrade postgresql16-contribUpgrade postgresql14-contribUpgrade postgresql15-llvmjit-devel | May 16, 2024 | May 14, 2024 |
| Ubuntu | — | Upgrade postgresql-16Upgrade postgresql-client-16Upgrade postgresql-14Upgrade postgresql-client-15Upgrade postgresql-15Upgrade postgresql-client-14 | Jun 6, 2024 | May 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 9, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub