Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufsUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-private-develUpgrade postgresql-serverUpgrade pgauditUpgrade postgresql-private-libsUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-staticUpgrade pg_repackUpgrade postgresql-pltclUpgrade postgresql-docs | Aug 30, 2024 | May 14, 2024 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-upgrade-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-llvmjitUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-server | Jun 12, 2024 | May 14, 2024 |
| Amazon_linux_2023 | — | Upgrade postgresql15-upgradeUpgrade postgresql15-private-develUpgrade postgresql15Upgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-staticUpgrade postgresql15-private-libsUpgrade postgresql15-server-develUpgrade postgresql15-llvmjitUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-docsUpgrade postgresql15-debuginfoUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-plpython3Upgrade postgresql15-plperl-debuginfoUpgrade postgresql15-serverUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-testUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-contribUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql15-test-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-pltclUpgrade postgresql15-plperlUpgrade postgresql15-upgrade-develUpgrade postgresql15-debugsourceUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-llvmjit-debuginfo | Feb 17, 2025 | May 9, 2024 |
| Debian | — | Upgrade postgresql-15 | Oct 28, 2024 | May 14, 2024 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | May 9, 2024 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 8, 2024 | May 14, 2024 |
| Oracle_linux | — | Upgrade postgresql-pltclUpgrade postgresqlUpgrade postgres-decoderbufsUpgrade pg_repackUpgrade postgresql-contribUpgrade postgresql-private-develUpgrade postgresql-serverUpgrade postgresql-test-rpm-macrosUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-plperlUpgrade postgresql-docsUpgrade pgauditUpgrade postgresql-upgrade-develUpgrade postgresql-private-libsUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-server-devel | Oct 16, 2024 | May 9, 2024 |
| Postgres | — | Upgrade to PostgreSQL version 16.3Upgrade to PostgreSQL version 14.12Upgrade to PostgreSQL version 15.7 | May 13, 2024 | May 9, 2024 |
| Redhat_linux | — | Upgrade postgresql-private-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgauditUpgrade postgresql-contribUpgrade pg_repack-debugsourceUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-private-libs-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-server-develUpgrade pgaudit-debuginfoUpgrade postgresql-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade pg_repackUpgrade postgresql-plperlUpgrade postgresql-plpython3Upgrade postgresql-server-debuginfoUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-serverUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-docs-debuginfoNo solution existsUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-pltclUpgrade postgresql-private-libsUpgrade postgresql-testUpgrade postgresql-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgresqlUpgrade postgresql-test-debuginfo | Sep 13, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade postgresqlUpgrade postgresql-plperlUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-testUpgrade postgresql-private-libsUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-upgrade-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-serverUpgrade pg_repack-debugsourceUpgrade pg_repack-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-plperl-debuginfoUpgrade postgresql-private-develUpgrade pgauditUpgrade pg_repackUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-private-libs-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-upgrade-devel-debuginfo | Sep 17, 2024 | May 14, 2024 |
| Suse | — | Upgrade libecpg6Upgrade postgresql14-serverUpgrade postgresql15-develUpgrade postgresql16-pltclUpgrade postgresql15-serverUpgrade postgresql14-testUpgrade postgresql15-testUpgrade postgresql15-plperlUpgrade postgresql16-server-develUpgrade postgresql14Upgrade postgresql16Upgrade postgresql15-docsUpgrade postgresql15-server-develUpgrade postgresql16-llvmjitUpgrade postgresql16-plpythonUpgrade postgresql14-pltclUpgrade postgresql14-server-develUpgrade postgresql16-develUpgrade postgresql16-contribUpgrade postgresql15-pltclUpgrade postgresql14-docsUpgrade postgresql14-llvmjitUpgrade postgresql16-testUpgrade libpq5Upgrade postgresql16-plperlUpgrade postgresql16-docsUpgrade postgresql16-llvmjit-develUpgrade postgresql15Upgrade postgresql16-serverUpgrade libpq5-32bitUpgrade postgresql15-llvmjitUpgrade postgresql14-llvmjit-develUpgrade libecpg6-32bitUpgrade postgresql14-plpythonUpgrade postgresql15-contribUpgrade postgresql14-contribUpgrade postgresql15-plpythonUpgrade postgresql15-llvmjit-develUpgrade postgresql14-develUpgrade postgresql16-devel-miniUpgrade postgresql14-plperl | May 16, 2024 | May 14, 2024 |
| Ubuntu | — | Upgrade postgresql-client-14Upgrade postgresql-client-15Upgrade postgresql-15Upgrade postgresql-client-16Upgrade postgresql-14Upgrade postgresql-16 | Jun 6, 2024 | May 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 9, 2024 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub