Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.
Metrics
Affected Vendors & Products
References
History
Fri, 20 Dec 2024 13:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
References |
|
MITRE
Status: PUBLISHED
Assigner: PostgreSQL
Published: 2024-02-08T13:00:02.411Z
Updated: 2024-12-20T13:06:41.461Z
Reserved: 2024-01-27T20:47:02.113Z
Link: CVE-2024-0985
Vulnrichment
No data.
NVD
Status : Modified
Published: 2024-02-08T13:15:08.927
Modified: 2024-12-20T13:15:19.070
Link: CVE-2024-0985
Redhat