Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.

The version of postgresql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-4317 advisory.

  - Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an     unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands     of other users. The most common values May reveal column values the eavesdropper could not otherwise read     or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL     installations, namely those that are created with the initdb utility after installing that version.
    Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release     notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected.
    Versions before PostgreSQL 14 are unaffected. (CVE-2024-4317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2266-1 advisory.

    PostgreSQL upgrade to version 16.3 (bsc#1224051):

    - CVE-2024-4317: Fixed visibility restriction of pg_stats_ext and pg_stats_ext_exprs entries to the table     owner (bsc#1224038).

    Bug fixes:

    - Fix incompatibility with LLVM 18.
    - Prepare for PostgreSQL 17.
    - Make sure all compilation and doc generation happens in %build.
    - Require LLVM <= 17 for now, because LLVM 18 doesn't seem to work.
    - Remove constraints file because improved memory usage for s390x
    - Use %patch -P N instead of deprecated %patchN.

    Release notes:

    - https://www.postgresql.org/docs/release/16.3/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2261-1 advisory.

    - Upgrade to 15.7. (bsc#1224051)
    - CVE-2024-4317: Restrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table owner.
    See release notes for the steps that have to be taken to fix existing PostgreSQL instances. (bsc#1224038)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2262-1 advisory.

    - Upgrade to 14.12 (bsc#1224051):
    - CVE-2024-4317: Restrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table owner.
    See release notes for the steps that have to be taken to fix existing PostgreSQL instances. (bsc#1224038)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of postgresql installed on the remote host is prior to 14.12-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-011 advisory.

    postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-635 advisory.

    postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.10 / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6802-1 advisory.

    Lukas Fittl discovered that PostgreSQL incorrectly performed authorization in the built-in pg_stats_ext     and pg_stats_ext_exprs views. An unprivileged database user can use this issue to read most common values     and other statistics from CREATE STATISTICS commands of other users.

    NOTE: This update will only fix fresh PostgreSQL installations. Current PostgreSQL installations will     remain vulnerable to this issue until manual steps are performed. Please see the instructions in the     changelog located at /usr/share/doc/postgresql-*/changelog.Debian.gz after the updated packages have been     installed, or in the PostgreSQL release notes located here:

    https://www.postgresql.org/docs/16/release-16-3.html https://www.postgresql.org/docs/15/release-15-7.html     https://www.postgresql.org/docs/14/release-14-12.html

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1777-1 advisory.

    PostgreSQL upgrade to version 15.7 (bsc#1224051):

    - CVE-2024-4317: Fixed visibility restriction of pg_stats_ext and pg_stats_ext_exprs entries to the table     owner (bsc#1224038).

    Bug fixes:

    - Fix incompatibility with LLVM 18.
    - Prepare for PostgreSQL 17.
    - Make sure all compilation and doc generation happens in %build.
    - Require LLVM <= 17 for now, because LLVM 18 doesn't seem to work.
    - Remove constraints file because improved memory usage for s390x
    - Use %patch -P N instead of deprecated %patchN.

    Release notes:

    - https://www.postgresql.org/docs/release/15.7/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1768-1 advisory.

    PostgreSQL upgrade to version 14.12 (bsc#1224051):

    - CVE-2024-4317: Fixed visibility restriction of pg_stats_ext and pg_stats_ext_exprs entries to the table     owner (bsc#1224038).

    Bug fixes:

    - Fix incompatibility with LLVM 18.
    - Prepare for PostgreSQL 17.
    - Make sure all compilation and doc generation happens in %build.
    - Require LLVM <= 17 for now, because LLVM 18 doesn't seem to work.
    - Remove constraints file because improved memory usage for s390x
    - Use %patch -P N instead of deprecated %patchN.

    Release notes:

    - https://www.postgresql.org/docs/release/14.12/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of PostgreSQL installed on the remote host is 14 prior to 14.12, 15 prior to 15.7, or 16 prior to 16.3. As such, it is potentially affected by a vulnerability :

  - Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an     unprivileged database user to read most common values and other statistics from CREATE STATISTICS     commands of other users. The most common values may reveal column values the eavesdropper could not     otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes     fresh PostgreSQL installations, namely those that are created with the initdb utility after installing     that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions     in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and     14.12 are affected. Versions before PostgreSQL 14 are unaffected. (CVE-2024-4317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1703-1 advisory.

  - Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an     unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands     of other users. The most common values may reveal column values the eavesdropper could not otherwise read     or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL     installations, namely those that are created with the initdb utility after installing that version.
    Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release     notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected.
    Versions before PostgreSQL 14 are unaffected. (CVE-2024-4317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1651-1 advisory.

  - Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an     unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands     of other users. The most common values may reveal column values the eavesdropper could not otherwise read     or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL     installations, namely those that are created with the initdb utility after installing that version.
    Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release     notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected.
    Versions before PostgreSQL 14 are unaffected. (CVE-2024-4317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1652-1 advisory.

  - Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an     unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands     of other users. The most common values may reveal column values the eavesdropper could not otherwise read     or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL     installations, namely those that are created with the initdb utility after installing that version.
    Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release     notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected.
    Versions before PostgreSQL 14 are unaffected. (CVE-2024-4317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1653-1 advisory.

  - Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an     unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands     of other users. The most common values may reveal column values the eavesdropper could not otherwise read     or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL     installations, namely those that are created with the initdb utility after installing that version.
    Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release     notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected.
    Versions before PostgreSQL 14 are unaffected. (CVE-2024-4317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the d53c30c1-0d7b-11ef-ba02-6cc21735f730 advisory.

  - Restrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table ownermore details     (CVE-2024-4317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
201691	CBL Mariner 2.0 Security Update: postgresql (CVE-2024-4317)	Nessus	MarinerOS Local Security Checks	low
201331	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : postgresql16 (SUSE-SU-2024:2266-1)	Nessus	SuSE Local Security Checks	low
201330	SUSE SLES15 / openSUSE 15 Security Update : postgresql15 (SUSE-SU-2024:2261-1)	Nessus	SuSE Local Security Checks	low
201327	SUSE SLES15 / openSUSE 15 Security Update : postgresql14 (SUSE-SU-2024:2262-1)	Nessus	SuSE Local Security Checks	low
200365	Amazon Linux 2 : postgresql (ALASPOSTGRESQL14-2024-011)	Nessus	Amazon Linux Local Security Checks	low
200265	Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2024-635)	Nessus	Amazon Linux Local Security Checks	low
198154	Ubuntu 22.04 LTS / 23.10 / 24.04 LTS : PostgreSQL vulnerability (USN-6802-1)	Nessus	Ubuntu Local Security Checks	low
197919	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : postgresql15 (SUSE-SU-2024:1777-1)	Nessus	SuSE Local Security Checks	low
197891	SUSE SLES15 / openSUSE 15 Security Update : postgresql14 (SUSE-SU-2024:1768-1)	Nessus	SuSE Local Security Checks	low
197741	PostgreSQL 14.x < 14.12 / 15.x < 15.7 / 16.x < 16.3 Missing Authorization Check	Nessus	Databases	low
197549	SUSE SLES12 Security Update : postgresql14 (SUSE-SU-2024:1703-1)	Nessus	SuSE Local Security Checks	low
197175	SUSE SLES12 Security Update : postgresql16 (SUSE-SU-2024:1651-1)	Nessus	SuSE Local Security Checks	low
197172	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : postgresql16 (SUSE-SU-2024:1652-1)	Nessus	SuSE Local Security Checks	low
197170	SUSE SLES12 Security Update : postgresql15 (SUSE-SU-2024:1653-1)	Nessus	SuSE Local Security Checks	low
195319	FreeBSD : PostgreSQL server -- Potentially allowing authenicated database users to see data that they shouldn't. (d53c30c1-0d7b-11ef-ba02-6cc21735f730)	Nessus	FreeBSD Local Security Checks	low

Detections

Analytics

CVE-2024-4317

low

Tenable Plugins

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low