Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
PostgreSQL Database Allows Unwanted SQL Execution
published 2 years ago
Summary
An update is available for PostgreSQL to prevent unauthorized SQL commands from being executed. This update affects database administrators who manage PostgreSQL databases. To protect your system, apply the latest security update as soon as possible.
What to do
- Update almalinux postgresql to version 13.14-1.el9_3.
- Update almalinux postgresql-contrib to version 13.14-1.el9_3.
- Update almalinux postgresql-docs to version 13.14-1.el9_3.
- Update almalinux postgresql-plperl to version 13.14-1.el9_3.
- Update almalinux postgresql-plpython3 to version 13.14-1.el9_3.
- Update almalinux postgresql-pltcl to version 13.14-1.el9_3.
- Update almalinux postgresql-private-devel to version 13.14-1.el9_3.
- Update almalinux postgresql-private-libs to version 13.14-1.el9_3.
- Update almalinux postgresql-server to version 13.14-1.el9_3.
- Update almalinux postgresql-server-devel to version 13.14-1.el9_3.
- Update almalinux postgresql-static to version 13.14-1.el9_3.
- Update almalinux postgresql-test to version 13.14-1.el9_3.
- Update almalinux postgresql-upgrade to version 13.14-1.el9_3.
- Update almalinux postgresql-upgrade-devel to version 13.14-1.el9_3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:9 | almalinux | postgresql |
< 13.14-1.el9_3 Fix: upgrade to 13.14-1.el9_3
|
| AlmaLinux:9 | almalinux | postgresql-contrib |
< 13.14-1.el9_3 Fix: upgrade to 13.14-1.el9_3
|
| AlmaLinux:9 | almalinux | postgresql-docs |
< 13.14-1.el9_3 Fix: upgrade to 13.14-1.el9_3
|
| AlmaLinux:9 | almalinux | postgresql-plperl |
< 13.14-1.el9_3 Fix: upgrade to 13.14-1.el9_3
|
| AlmaLinux:9 | almalinux | postgresql-plpython3 |
< 13.14-1.el9_3 Fix: upgrade to 13.14-1.el9_3
|
| AlmaLinux:9 | almalinux | postgresql-pltcl |
< 13.14-1.el9_3 Fix: upgrade to 13.14-1.el9_3
|
| AlmaLinux:9 | almalinux | postgresql-private-devel |
< 13.14-1.el9_3 Fix: upgrade to 13.14-1.el9_3
|
| AlmaLinux:9 | almalinux | postgresql-private-libs |
< 13.14-1.el9_3 Fix: upgrade to 13.14-1.el9_3
|
| AlmaLinux:9 | almalinux | postgresql-server |
< 13.14-1.el9_3 Fix: upgrade to 13.14-1.el9_3
|
| AlmaLinux:9 | almalinux | postgresql-server-devel |
< 13.14-1.el9_3 Fix: upgrade to 13.14-1.el9_3
|
| AlmaLinux:9 | almalinux | postgresql-static |
< 13.14-1.el9_3 Fix: upgrade to 13.14-1.el9_3
|
| AlmaLinux:9 | almalinux | postgresql-test |
< 13.14-1.el9_3 Fix: upgrade to 13.14-1.el9_3
|
| AlmaLinux:9 | almalinux | postgresql-upgrade |
< 13.14-1.el9_3 Fix: upgrade to 13.14-1.el9_3
|
| AlmaLinux:9 | almalinux | postgresql-upgrade-devel |
< 13.14-1.el9_3 Fix: upgrade to 13.14-1.el9_3
|
Original advisory text
Important: postgresql security update
PostgreSQL is an advanced object-relational database management system (DBMS).
Security Fix(es):
* postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2024:0951 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2024-0985 Third Party Advisory
- https://bugzilla.redhat.com/2263384 Third Party Advisory
- https://errata.almalinux.org/9/ALSA-2024-0951.html Vendor Advisory
Timeline
Published22 Feb 2024
Updated29 Mar 2026
First seen29 Mar 2026
Sources
ALSA-2024:0951 · OSV
Track software like this
Free during beta