Missing Authorization in PostgreSQL - CVE-2024-4317

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU89297

Missing Authorization in PostgreSQL - CVE-2024-4317

Published: May 9, 2024


Vulnerability identifier: #VU89297
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-4317
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs. A remote user can read most common values and other statistics from CREATE STATISTICS commands of other users.


Affected software

PostgreSQL
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Basesystem Module
Legacy Module
SUSE Package Hub 15
Server Applications Module
openSUSE Leap
Ubuntu
InfoScale Operations Manager
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Sterling Connect:Direct Web Services
IBM Cloud Pak for Business Automation
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Storage Copy Data Management
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
Storage Protect Plus Server
pg_repack
pgaudit
postgres-decoderbufs
postgresql-client-14 (Ubuntu package)
postgresql-14 (Ubuntu package)
postgresql14-plpython
postgresql14-plperl
postgresql14-pltcl-debuginfo
postgresql14-contrib
postgresql14-server-debuginfo
postgresql14-plperl-debuginfo
postgresql14-plpython-debuginfo
postgresql14
postgresql14-pltcl
postgresql14-server
postgresql14-debuginfo
postgresql14-docs
postgresql14-contrib-debuginfo
postgresql14-server-devel-debuginfo
postgresql14-server-devel
postgresql14-debugsource
postgresql14-devel-debuginfo
postgresql14-devel
postgresql14-llvmjit
postgresql14-llvmjit-devel
postgresql14-test
postgresql14-llvmjit-debuginfo
postgresql-15 (Ubuntu package)
postgresql-client-15 (Ubuntu package)
postgresql15
postgresql15-server-devel-debuginfo
postgresql15-devel
postgresql15-plperl
postgresql15-debuginfo
postgresql15-pltcl-debuginfo
postgresql15-debugsource
postgresql15-plpython-debuginfo
postgresql15-contrib-debuginfo
postgresql15-server-devel
postgresql15-server
postgresql15-plperl-debuginfo
postgresql15-server-debuginfo
postgresql15-plpython
postgresql15-pltcl
postgresql15-contrib
postgresql15-docs
postgresql15-devel-debuginfo
postgresql15-test
postgresql15-llvmjit-devel
postgresql15-llvmjit
postgresql15-llvmjit-debuginfo
postgresql-test-rpm-macros
postgresql-private-devel
postgresql-upgrade-devel
postgresql-upgrade
postgresql-test
postgresql-static
postgresql-server-devel
postgresql-server
postgresql-pltcl
postgresql-plpython3
postgresql-plperl
postgresql-docs
postgresql-contrib
postgresql
postgresql-private-libs
libpq5
postgresql16-contrib-debuginfo
postgresql16-pltcl
postgresql16-server-debuginfo
postgresql16-plpython-debuginfo
postgresql16
postgresql16-llvmjit-devel
libecpg6-debuginfo
postgresql16-devel
postgresql16-server-devel-debuginfo
postgresql16-plperl-debuginfo
postgresql16-llvmjit-debuginfo
libecpg6-32bit-debuginfo
libecpg6-32bit
libpq5-32bit-debuginfo
libpq5-32bit
postgresql16-docs
libpq5-64bit-debuginfo
libecpg6-64bit-debuginfo
libpq5-64bit
libecpg6-64bit
postgresql16-llvmjit
postgresql16-mini-debugsource
postgresql16-plperl
postgresql16-plpython
postgresql16-devel-mini
postgresql16-server-devel
postgresql16-server
postgresql16-debuginfo
libecpg6
postgresql16-devel-debuginfo
postgresql16-devel-mini-debuginfo
postgresql16-contrib
postgresql16-test
postgresql16-debugsource
postgresql16-pltcl-debuginfo
libpq5-debuginfo
postgresql-client-16 (Ubuntu package)
postgresql-16 (Ubuntu package)
libecpg6-debuginfo-32bit
libpq5-debuginfo-32bit
Juniper Secure Analytics (JSA)

How to mitigate CVE-2024-4317

Install updates from vendor's website.

PostgreSQL - addressed in versions 14.12, 15.7, 16.3
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
pg_repack - update to 1.4.8-1
pgaudit - update to 1.7.0-1
postgres-decoderbufs - update to 1.9.7-1.Final
Storage Copy Data Management - update to 2.2.24.1
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.1
watsonx Assistant Cartridge - update to 5.1.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.1.1
IBM Sterling Connect:Direct Web Services - addressed in versions 6.1.0.25, 6.2.0.24, 6.3.0.8
Juniper Secure Analytics (JSA) - update to 7.5.0 UP11 IF03
Storage Protect Plus Server - update to 10.1.16.3
postgresql-client-14 (Ubuntu package) - update to 14.12-0ubuntu0.22.04.1
postgresql-14 (Ubuntu package) - update to 14.12-0ubuntu0.22.04.1
postgresql14-plpython - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-plperl - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-pltcl-debuginfo - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-contrib - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-server-debuginfo - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-plperl-debuginfo - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-plpython-debuginfo - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14 - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-pltcl - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-server - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-debuginfo - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-docs - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-contrib-debuginfo - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-server-devel-debuginfo - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-server-devel - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-debugsource - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-devel-debuginfo - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-devel - addressed in versions 14.12-3.41.1, 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-llvmjit - addressed in versions 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-llvmjit-devel - addressed in versions 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-test - addressed in versions 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql14-llvmjit-debuginfo - addressed in versions 14.12-150200.5.44.1, 14.12-150600.16.3.1
postgresql-15 (Ubuntu package) - update to 15.7-0ubuntu0.23.10.1
postgresql-client-15 (Ubuntu package) - update to 15.7-0ubuntu0.23.10.1
postgresql15 - update to 15.7-1
postgresql15-server-devel-debuginfo - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-devel - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-plperl - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-debuginfo - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-pltcl-debuginfo - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-debugsource - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-plpython-debuginfo - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-contrib-debuginfo - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-server-devel - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-server - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-plperl-debuginfo - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-server-debuginfo - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-plpython - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-pltcl - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-contrib - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15 - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-docs - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-devel-debuginfo - addressed in versions 15.7-3.25.1, 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-test - addressed in versions 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-llvmjit-devel - addressed in versions 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-llvmjit - addressed in versions 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql15-llvmjit-debuginfo - addressed in versions 15.7-150200.5.27.1, 15.7-150600.16.3.1
postgresql-test-rpm-macros - update to 15.8-1.0.1
postgresql-private-devel - update to 15.8-1.0.1
postgresql-upgrade-devel - update to 15.8-1.0.1
postgresql-upgrade - update to 15.8-1.0.1
postgresql-test - update to 15.8-1.0.1
postgresql-static - update to 15.8-1.0.1
postgresql-server-devel - update to 15.8-1.0.1
postgresql-server - update to 15.8-1.0.1
postgresql-pltcl - update to 15.8-1.0.1
postgresql-plpython3 - update to 15.8-1.0.1
postgresql-plperl - update to 15.8-1.0.1
postgresql-docs - update to 15.8-1.0.1
postgresql-contrib - update to 15.8-1.0.1
postgresql - update to 15.8-1.0.1
postgresql-private-libs - update to 15.8-1.0.1
libpq5 - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-contrib-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-pltcl - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-server-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-plpython-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16 - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-llvmjit-devel - addressed in versions 16.2-150600.16.2.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
libecpg6-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-devel - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-server-devel-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-plperl-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-llvmjit-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
libecpg6-32bit-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
libecpg6-32bit - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
libpq5-32bit-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
libpq5-32bit - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-docs - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
libpq5-64bit-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.4-150600.16.5.1
libecpg6-64bit-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.4-150600.16.5.1
libpq5-64bit - addressed in versions 16.2-150600.16.2.1, 16.4-150600.16.5.1
libecpg6-64bit - addressed in versions 16.2-150600.16.2.1, 16.4-150600.16.5.1
postgresql16-llvmjit - addressed in versions 16.2-150600.16.2.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-mini-debugsource - addressed in versions 16.2-150600.16.2.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-plperl - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-plpython - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-devel-mini - addressed in versions 16.2-150600.16.2.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-server-devel - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-server - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
libecpg6 - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-devel-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-devel-mini-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-contrib - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-test - addressed in versions 16.2-150600.16.2.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-debugsource - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql16-pltcl-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
libpq5-debuginfo - addressed in versions 16.2-150600.16.2.1, 16.3-3.13.1, 16.3-150200.5.13.1, 16.4-150600.16.5.1
postgresql-client-16 (Ubuntu package) - update to 16.3-0ubuntu0.24.04.1
postgresql-16 (Ubuntu package) - update to 16.3-0ubuntu0.24.04.1
libecpg6-debuginfo-32bit - update to 16.3-3.13.1
libpq5-debuginfo-32bit - update to 16.3-3.13.1
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF004, 24.0.1-IF001

External References

Related Security Bulletins