Vulnerability CVE-2024-4317: Information

Description

Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.

Published: May 14, 2024
Modified: May 14, 2024

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
postgresql14sisyphus14.12-alt114.12-alt3ALT-PU-2024-7778-1348085Fixed
postgresql14sisyphus_e2k14.12-alt114.12-alt3ALT-PU-2024-7836-1-Fixed
postgresql14sisyphus_loongarch6414.12-alt114.12-alt3ALT-PU-2024-7846-1-Fixed
postgresql14p1014.12-alt0.p10.114.12-alt0.p10.1ALT-PU-2024-7786-2348101Fixed
postgresql14p10_e2k14.12-alt0.p10.114.12-alt0.p10.1ALT-PU-2024-8060-1-Fixed
postgresql14c10f114.12-alt0.p10.114.12-alt0.p10.1ALT-PU-2024-7930-2348133Fixed
postgresql14p1114.12-alt114.12-alt3ALT-PU-2024-7778-1348085Fixed
postgresql15sisyphus15.7-alt115.7-alt3ALT-PU-2024-7779-1348085Fixed
postgresql15sisyphus_e2k15.7-alt115.7-alt3ALT-PU-2024-7837-1-Fixed
postgresql15sisyphus_loongarch6415.7-alt115.7-alt3ALT-PU-2024-7847-1-Fixed
postgresql15p1015.7-alt0.p10.115.7-alt0.p10.1ALT-PU-2024-7785-2348101Fixed
postgresql15p10_e2k15.7-alt0.p10.115.7-alt0.p10.1ALT-PU-2024-8061-1-Fixed
postgresql15c10f115.7-alt0.c10f1.115.7-alt0.c10f1.1ALT-PU-2024-7929-2348133Fixed
postgresql15p1115.7-alt115.7-alt3ALT-PU-2024-7779-1348085Fixed
postgresql15-1Cp1015.7-alt0.p10.115.7-alt0.p10.1ALT-PU-2024-7787-2348101Fixed
postgresql15-1Cp10_e2k15.7-alt0.p10.115.7-alt0.p10.1ALT-PU-2024-8062-1-Fixed
postgresql15-1Cc10f115.7-alt0.p10.115.7-alt0.p10.1ALT-PU-2024-7927-2348133Fixed
postgresql16sisyphus16.3-alt116.3-alt3ALT-PU-2024-7776-1348085Fixed
postgresql16sisyphus_e2k16.3-alt116.3-alt3ALT-PU-2024-7834-1-Fixed
postgresql16sisyphus_loongarch6416.3-alt116.3-alt3ALT-PU-2024-7845-1-Fixed
postgresql16p1016.3-alt0.p10.116.3-alt0.p10.1ALT-PU-2024-7783-2348101Fixed
postgresql16p10_e2k16.3-alt0.p10.116.3-alt0.p10.1ALT-PU-2024-8058-1-Fixed
postgresql16p1116.3-alt116.3-alt3ALT-PU-2024-7776-1348085Fixed

References to Advisories, Solutions, and Tools