CVE-2024-0985: postgresql Privilege Dropping / Lowering Errors
Vulnerability summary
CVE-2024-0985 is a high (CVSS 8.0) Privilege Dropping / Lowering Errors vulnerability in postgresql. EPSS estimates a 1.81% chance of exploitation in the next 30 days, higher than 78.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 7Timeline
- 08-02-2024PublishedVulnerability first disclosed.
- 13-06-2025Last modifiedVulnerability information updated.
Description
Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.
CVSS metrics
8 scores · 8 sources · 1 version- OSV · AlpineEcosystem advisory · calculated8.0HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated8.0HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.0HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.0HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated8.0HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.0HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.0HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.81%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.81% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat83 products
- pg_repack< 0:1.4.6-3.module+el8.5.0+11354+78b3c9c5 | < 0:1.4.8-1.module+el9.2.0+17405+aeb9ec60 | < 0:1.4.6-3.module+el8.5.0+11357+bcc62552 | < 0:1.4.8-1.module+el8.9.0+19797+c4ce5969 | < 0:1.4.6-3.module+el8.9.0+19330+c97ddbdf | < 0:1.4.6-3.module+el8.9.0+20664+9c30cf7f | < 0:1.4.8-1.module+el8.8.0+17071+aaaceaa4
- pg_repack-debuginfo< 0:1.4.6-3.module+el8.5.0+11354+78b3c9c5 | < 0:1.4.8-1.module+el9.2.0+17405+aeb9ec60 | < 0:1.4.6-3.module+el8.5.0+11357+bcc62552 | < 0:1.4.8-1.module+el8.9.0+19797+c4ce5969 | < 0:1.4.6-3.module+el8.9.0+19330+c97ddbdf | < 0:1.4.6-3.module+el8.9.0+20664+9c30cf7f | < 0:1.4.8-1.module+el8.8.0+17071+aaaceaa4
- pg_repack-debugsource< 0:1.4.6-3.module+el8.5.0+11354+78b3c9c5 | < 0:1.4.8-1.module+el9.2.0+17405+aeb9ec60 | < 0:1.4.6-3.module+el8.5.0+11357+bcc62552 | < 0:1.4.8-1.module+el8.9.0+19797+c4ce5969 | < 0:1.4.6-3.module+el8.9.0+19330+c97ddbdf | < 0:1.4.6-3.module+el8.9.0+20664+9c30cf7f | < 0:1.4.8-1.module+el8.8.0+17071+aaaceaa4
- pgaudit< 0:1.4.0-5.module+el8.5.0+11354+78b3c9c5 | < 0:1.4.0-4.module+el8.2.0+9043+1dbb5661 | < 0:1.4.0-6.module+el8.4.0+11288+c193d6d7 | < 0:1.7.0-1.module+el9.2.0+17405+aeb9ec60 | < 0:1.5.0-1.module+el8.4.0+8873+b821c30a | < 0:1.7.0-1.module+el8.9.0+19797+c4ce5969 | < 0:1.4.0-7.module+el8.9.0+21289+7c796f9d | < 0:1.5.0-1.module+el8.9.0+20664+9c30cf7f | < 0:1.7.0-1.module+el8.8.0+17071+aaaceaa4
- pgaudit-debuginfo< 0:1.4.0-5.module+el8.5.0+11354+78b3c9c5 | < 0:1.4.0-4.module+el8.2.0+9043+1dbb5661 | < 0:1.4.0-6.module+el8.4.0+11288+c193d6d7 | < 0:1.7.0-1.module+el9.2.0+17405+aeb9ec60 | < 0:1.5.0-1.module+el8.4.0+8873+b821c30a | < 0:1.7.0-1.module+el8.9.0+19797+c4ce5969 | < 0:1.4.0-7.module+el8.9.0+21289+7c796f9d | < 0:1.5.0-1.module+el8.9.0+20664+9c30cf7f | < 0:1.7.0-1.module+el8.8.0+17071+aaaceaa4
Suse76 products
- postgresql12&distro=SUSE Enterprise Storage 7.1< 12.18-150200.8.57.1
- postgresql12&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 12.18-150200.8.57.1
- postgresql12&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 12.18-150200.8.57.1
- postgresql12&distro=SUSE Linux Enterprise Server 12 SP5< 12.18-3.52.1
- postgresql12&distro=SUSE Linux Enterprise Server 15 SP2-LTSS< 12.18-150200.8.57.1
Opensuse10 products
- postgresql12&distro=openSUSE Leap 15.5< 12.18-150200.8.57.1
- postgresql13&distro=openSUSE Leap 15.5< 13.14-150200.5.53.1
- postgresql13&distro=openSUSE Tumbleweed< 13.14-1.1
- postgresql14&distro=openSUSE Leap 15.5< 14.11-150200.5.39.1
- postgresql14&distro=openSUSE Tumbleweed< 14.11-1.1
Ubuntu6 products
- postgresql-10All versions (No fix recorded)
- postgresql-12< 12.18-0ubuntu0.20.04.1
- postgresql-14< 14.11-0ubuntu0.22.04.1
- postgresql-16< 16.2-1
- postgresql-9.3All versions (No fix recorded)
Alpine4 products
- postgresql13< 13.14-r0
- postgresql14< 14.11-r0
- postgresql15< 15.6-r0
- postgresql16< 16.2-r0
Chainguard4 products
- postgresql-12< 12.18-r0
- postgresql-13< 13.14-r0
- postgresql-14< 14.11-r0
- postgresql-15< 15.6-r0
Wolfi4 products
- postgresql-12< 12.18-r0
- postgresql-13< 13.14-r0
- postgresql-14< 14.11-r0
- postgresql-15< 15.6-r0
Debian3 products
- postgresql-11< 11.22-0+deb10u2
- postgresql-13< 13.14-0+deb11u1
- postgresql-15< 15.6-0+deb12u1
Mageia2 products
- postgresql13< 13.14-1.mga9
- postgresql15< 15.6-1.mga9
Postgresql1 product
- postgresql≥ 12.0, < 12.18 | ≥ 13.0, < 13.14 | ≥ 14.0, < 14.11 | ≥ 15.0, < 15.6
10 vendors · 193 products