CVE-2024-0985 Report - Details, Severity, & Advisories
Twingate Team
•
Jun 13, 2024
What is CVE-2024-0985?
CVE-2024-0985 is a high-severity vulnerability affecting PostgreSQL, a popular database server. This security issue allows an attacker to execute arbitrary SQL functions by exploiting a late privilege drop in the REFRESH MATERIALIZED VIEW CONCURRENTLY command. Users are advised to update their PostgreSQL installations to the latest fixed versions to mitigate this vulnerability.
Who is impacted by this?
The CVE-2024-0985 vulnerability impacts PostgreSQL users, particularly superusers or members of an attacker's roles. Affected versions include PostgreSQL before 15.6, 14.11, 13.14, and 12.18. Additionally, users of the PostgreSQL-11 package on Debian 10 Buster with versions prior to 11.22-0+deb10u2 are at risk.
What should I do if I’m affected?
If you're affected by the CVE-2024-0985 vulnerability, take the following steps to secure your PostgreSQL installation:
Update PostgreSQL to the fixed versions: 15.6, 14.11, 13.14, or 12.18.
If using PostgreSQL-11 on Debian 10 Buster, upgrade the package to version 11.22-0+deb10u2.
For PostgreSQL 16 and later, update to version 16.2 for added protections.
Is this in CISA’s Known Exploited Vulnerabilities Catalog?
CVE-2024-0985 is not listed in CISA's Known Exploited Vulnerabilities Catalog. To protect your system, update PostgreSQL to a fixed version (15.6, 14.11, 13.14, or 12.18) or upgrade the PostgreSQL-11 package on Debian 10 Buster to version 11.22-0+deb10u2.
Weakness Enumeration
The weakness enumeration for this vulnerability is categorized as CWE-271, which involves privilege dropping or lowering errors in PostgreSQL.
Learn More
For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or refer to the links below.
Rapidly implement a modern Zero Trust network that is more secure and maintainable than VPNs.
CVE-2024-0985 Report - Details, Severity, & Advisories
Twingate Team
•
Jun 13, 2024
What is CVE-2024-0985?
CVE-2024-0985 is a high-severity vulnerability affecting PostgreSQL, a popular database server. This security issue allows an attacker to execute arbitrary SQL functions by exploiting a late privilege drop in the REFRESH MATERIALIZED VIEW CONCURRENTLY command. Users are advised to update their PostgreSQL installations to the latest fixed versions to mitigate this vulnerability.
Who is impacted by this?
The CVE-2024-0985 vulnerability impacts PostgreSQL users, particularly superusers or members of an attacker's roles. Affected versions include PostgreSQL before 15.6, 14.11, 13.14, and 12.18. Additionally, users of the PostgreSQL-11 package on Debian 10 Buster with versions prior to 11.22-0+deb10u2 are at risk.
What should I do if I’m affected?
If you're affected by the CVE-2024-0985 vulnerability, take the following steps to secure your PostgreSQL installation:
Update PostgreSQL to the fixed versions: 15.6, 14.11, 13.14, or 12.18.
If using PostgreSQL-11 on Debian 10 Buster, upgrade the package to version 11.22-0+deb10u2.
For PostgreSQL 16 and later, update to version 16.2 for added protections.
Is this in CISA’s Known Exploited Vulnerabilities Catalog?
CVE-2024-0985 is not listed in CISA's Known Exploited Vulnerabilities Catalog. To protect your system, update PostgreSQL to a fixed version (15.6, 14.11, 13.14, or 12.18) or upgrade the PostgreSQL-11 package on Debian 10 Buster to version 11.22-0+deb10u2.
Weakness Enumeration
The weakness enumeration for this vulnerability is categorized as CWE-271, which involves privilege dropping or lowering errors in PostgreSQL.
Learn More
For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or refer to the links below.
Rapidly implement a modern Zero Trust network that is more secure and maintainable than VPNs.
CVE-2024-0985 Report - Details, Severity, & Advisories
Twingate Team
•
Jun 13, 2024
What is CVE-2024-0985?
CVE-2024-0985 is a high-severity vulnerability affecting PostgreSQL, a popular database server. This security issue allows an attacker to execute arbitrary SQL functions by exploiting a late privilege drop in the REFRESH MATERIALIZED VIEW CONCURRENTLY command. Users are advised to update their PostgreSQL installations to the latest fixed versions to mitigate this vulnerability.
Who is impacted by this?
The CVE-2024-0985 vulnerability impacts PostgreSQL users, particularly superusers or members of an attacker's roles. Affected versions include PostgreSQL before 15.6, 14.11, 13.14, and 12.18. Additionally, users of the PostgreSQL-11 package on Debian 10 Buster with versions prior to 11.22-0+deb10u2 are at risk.
What should I do if I’m affected?
If you're affected by the CVE-2024-0985 vulnerability, take the following steps to secure your PostgreSQL installation:
Update PostgreSQL to the fixed versions: 15.6, 14.11, 13.14, or 12.18.
If using PostgreSQL-11 on Debian 10 Buster, upgrade the package to version 11.22-0+deb10u2.
For PostgreSQL 16 and later, update to version 16.2 for added protections.
Is this in CISA’s Known Exploited Vulnerabilities Catalog?
CVE-2024-0985 is not listed in CISA's Known Exploited Vulnerabilities Catalog. To protect your system, update PostgreSQL to a fixed version (15.6, 14.11, 13.14, or 12.18) or upgrade the PostgreSQL-11 package on Debian 10 Buster to version 11.22-0+deb10u2.
Weakness Enumeration
The weakness enumeration for this vulnerability is categorized as CWE-271, which involves privilege dropping or lowering errors in PostgreSQL.
Learn More
For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or refer to the links below.
Solutions
Solutions
The VPN replacement your workforce will love.
Solutions