FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

postgresql-server -- non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL

Affected packages
postgresql-server < 15.6
postgresql-server < 14.11
postgresql-server < 13.14
postgresql-server < 12.18


VuXML ID 19e6dd1b-c6a5-11ee-9cd0-6cc21735f730
Discovery 2024-02-08
Entry 2024-02-08

PostgreSQL Project reports:

One step of a concurrent refresh command was run under weak security restrictions. If a materialized view's owner could persuade a superuser or other high-privileged user to perform a concurrent refresh on that view, the view's owner could control code executed with the privileges of the user running REFRESH. The fix for the vulnerability makes is so that all user-determined code is run as the view's owner, as expected.


CVE Name CVE-2024-0985