Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-pltclUpgrade pgauditUpgrade postgresql-testUpgrade postgresql-private-develUpgrade pg_repackUpgrade postgresql-plperlUpgrade postgresql-docsUpgrade postgresql-private-libsUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgres-decoderbufs | Aug 30, 2024 | May 14, 2024 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-llvmjitUpgrade postgresql-test-rpm-macrosUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-serverUpgrade postgresql-server-devel | Jun 12, 2024 | May 14, 2024 |
| Amazon_linux_2023 | — | Upgrade postgresql15-llvmjitUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-docsUpgrade postgresql15Upgrade postgresql15-private-develUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-staticUpgrade postgresql15-upgradeUpgrade postgresql15-server-develUpgrade postgresql15-private-libsUpgrade postgresql15-pltclUpgrade postgresql15-debugsourceUpgrade postgresql15-test-debuginfoUpgrade postgresql15-plpython3Upgrade postgresql15-debuginfoUpgrade postgresql15-upgrade-develUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-plperlUpgrade postgresql15-contribUpgrade postgresql15-server-debuginfoUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-testUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-server | Feb 17, 2025 | May 9, 2024 |
| Debian | — | Upgrade postgresql-15 | Oct 28, 2024 | May 14, 2024 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | May 9, 2024 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 8, 2024 | May 14, 2024 |
| Oracle_linux | — | Upgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-private-libsUpgrade postgresql-upgrade-develUpgrade postgresql-upgradeUpgrade postgres-decoderbufsUpgrade postgresql-serverUpgrade postgresql-testUpgrade pg_repackUpgrade postgresql-contribUpgrade postgresql-private-develUpgrade pgauditUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-test-rpm-macros | Oct 16, 2024 | May 9, 2024 |
| Postgres | — | Upgrade to PostgreSQL version 15.7Upgrade to PostgreSQL version 16.3Upgrade to PostgreSQL version 14.12 | May 13, 2024 | May 9, 2024 |
| Redhat_linux | — | Upgrade postgresql-plpython3Upgrade postgresql-staticUpgrade pg_repackUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-testUpgrade postgresql-private-libsNo solution existsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-upgradeUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-server-debuginfoUpgrade postgresqlUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-private-develUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-server-develUpgrade pgaudit-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgauditUpgrade pg_repack-debugsourceUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade pg_repack-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgres-decoderbufs | Sep 13, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade pg_repackUpgrade postgresql-debuginfoUpgrade postgresql-private-develUpgrade postgres-decoderbufsUpgrade pg_repack-debuginfoUpgrade pgaudit-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-plperl-debuginfoUpgrade postgresql-contribUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgauditUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-serverUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-testUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade postgresql-server-debuginfoUpgrade postgresql-docsUpgrade postgresql-upgrade-debuginfo | Sep 17, 2024 | May 14, 2024 |
| Suse | — | Upgrade postgresql15-plperlUpgrade postgresql16-llvmjitUpgrade postgresql14-testUpgrade postgresql16-server-develUpgrade postgresql15-docsUpgrade libecpg6Upgrade postgresql16Upgrade postgresql16-pltclUpgrade postgresql14-server-develUpgrade postgresql16-plpythonUpgrade postgresql16-develUpgrade postgresql14-serverUpgrade postgresql15-serverUpgrade postgresql15-testUpgrade postgresql15-develUpgrade postgresql15-server-develUpgrade postgresql14-pltclUpgrade postgresql14Upgrade libpq5-32bitUpgrade postgresql15-llvmjit-develUpgrade postgresql14-docsUpgrade postgresql15-plpythonUpgrade postgresql16-docsUpgrade postgresql16-llvmjit-develUpgrade postgresql14-llvmjitUpgrade postgresql16-plperlUpgrade postgresql14-plperlUpgrade postgresql16-testUpgrade postgresql16-devel-miniUpgrade libpq5Upgrade postgresql16-contribUpgrade postgresql14-contribUpgrade postgresql14-develUpgrade postgresql15-pltclUpgrade postgresql15Upgrade postgresql16-serverUpgrade postgresql15-contribUpgrade postgresql14-plpythonUpgrade postgresql14-llvmjit-develUpgrade libecpg6-32bitUpgrade postgresql15-llvmjit | May 16, 2024 | May 14, 2024 |
| Ubuntu | — | Upgrade postgresql-client-15Upgrade postgresql-15Upgrade postgresql-client-14Upgrade postgresql-client-16Upgrade postgresql-14Upgrade postgresql-16 | Jun 6, 2024 | May 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 9, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub