Unrated severityNVD Advisory· Published May 9, 2024· Updated Mar 28, 2025
PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks
CVE-2024-4317
Description
Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.
Affected products
124- PostgreSQL/PostgreSQLdescription
- osv-coords123 versionspkg:apk/chainguard/ecpg-14pkg:apk/chainguard/ecpg-15pkg:apk/chainguard/ecpg-16pkg:apk/chainguard/libecpg-14pkg:apk/chainguard/libecpg-14-devpkg:apk/chainguard/libecpg-15pkg:apk/chainguard/libecpg-15-devpkg:apk/chainguard/libecpg-16pkg:apk/chainguard/libecpg-16-devpkg:apk/chainguard/libpq-14pkg:apk/chainguard/libpq-15pkg:apk/chainguard/libpq-16pkg:apk/chainguard/postgresql-14pkg:apk/chainguard/postgresql-14-basepkg:apk/chainguard/postgresql-14-clientpkg:apk/chainguard/postgresql-14-client-basepkg:apk/chainguard/postgresql-14-contribpkg:apk/chainguard/postgresql-14-devpkg:apk/chainguard/postgresql-14-oci-entrypointpkg:apk/chainguard/postgresql-14-oci-entrypoint-basepkg:apk/chainguard/postgresql-14-pgadmin-compatpkg:apk/chainguard/postgresql-15pkg:apk/chainguard/postgresql-15-basepkg:apk/chainguard/postgresql-15-clientpkg:apk/chainguard/postgresql-15-client-basepkg:apk/chainguard/postgresql-15-contribpkg:apk/chainguard/postgresql-15-devpkg:apk/chainguard/postgresql-15-oci-entrypointpkg:apk/chainguard/postgresql-15-oci-entrypoint-basepkg:apk/chainguard/postgresql-15-pgadmin-compatpkg:apk/chainguard/postgresql-16pkg:apk/chainguard/postgresql-16-basepkg:apk/chainguard/postgresql-16-clientpkg:apk/chainguard/postgresql-16-client-basepkg:apk/chainguard/postgresql-16-contribpkg:apk/chainguard/postgresql-16-devpkg:apk/chainguard/postgresql-16-oci-entrypointpkg:apk/chainguard/postgresql-16-oci-entrypoint-basepkg:apk/chainguard/postgresql-16-pgadmin-compatpkg:apk/wolfi/ecpg-16pkg:apk/wolfi/libecpg-14pkg:apk/wolfi/libecpg-15pkg:apk/wolfi/libecpg-16pkg:apk/wolfi/libecpg-16-devpkg:apk/wolfi/libpq-14pkg:apk/wolfi/libpq-15pkg:apk/wolfi/libpq-16pkg:apk/wolfi/postgresql-14pkg:apk/wolfi/postgresql-14-basepkg:apk/wolfi/postgresql-14-clientpkg:apk/wolfi/postgresql-14-client-basepkg:apk/wolfi/postgresql-14-contribpkg:apk/wolfi/postgresql-14-devpkg:apk/wolfi/postgresql-14-oci-entrypointpkg:apk/wolfi/postgresql-14-oci-entrypoint-basepkg:apk/wolfi/postgresql-15pkg:apk/wolfi/postgresql-15-basepkg:apk/wolfi/postgresql-15-clientpkg:apk/wolfi/postgresql-15-client-basepkg:apk/wolfi/postgresql-15-contribpkg:apk/wolfi/postgresql-15-devpkg:apk/wolfi/postgresql-15-oci-entrypointpkg:apk/wolfi/postgresql-15-oci-entrypoint-basepkg:apk/wolfi/postgresql-16pkg:apk/wolfi/postgresql-16-basepkg:apk/wolfi/postgresql-16-clientpkg:apk/wolfi/postgresql-16-client-basepkg:apk/wolfi/postgresql-16-contribpkg:apk/wolfi/postgresql-16-devpkg:apk/wolfi/postgresql-16-oci-entrypointpkg:apk/wolfi/postgresql-16-oci-entrypoint-basepkg:apk/wolfi/postgresql-16-pgadmin-compatpkg:bitnami/postgresqlpkg:rpm/almalinux/pgauditpkg:rpm/almalinux/pg_repackpkg:rpm/almalinux/postgres-decoderbufspkg:rpm/almalinux/postgresqlpkg:rpm/almalinux/postgresql-contribpkg:rpm/almalinux/postgresql-docspkg:rpm/almalinux/postgresql-plperlpkg:rpm/almalinux/postgresql-plpython3pkg:rpm/almalinux/postgresql-pltclpkg:rpm/almalinux/postgresql-private-develpkg:rpm/almalinux/postgresql-private-libspkg:rpm/almalinux/postgresql-serverpkg:rpm/almalinux/postgresql-server-develpkg:rpm/almalinux/postgresql-staticpkg:rpm/almalinux/postgresql-testpkg:rpm/almalinux/postgresql-test-rpm-macrospkg:rpm/almalinux/postgresql-upgradepkg:rpm/almalinux/postgresql-upgrade-develpkg:rpm/opensuse/postgresql14&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/postgresql14&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/postgresql14&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/postgresql15&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/postgresql15&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/postgresql15&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/postgresql16&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/postgresql16&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/postgresql16&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/postgresql16-mini&distro=openSUSE%20Leap%2015.5pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP5pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP6pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP5pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP5pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP6pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP5pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/postgresql15&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP5pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP5pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP5pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP6pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/postgresql16&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5
< 14.19-r0+ 122 more
- (no CPE)range: < 14.19-r0
- (no CPE)range: < 15.14-r1
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 14.19-r0
- (no CPE)range: < 15.14-r1
- (no CPE)range: < 15.14-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 15.14-r1
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 14.19-r0
- (no CPE)range: < 14.19-r0
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 15.14-r0
- (no CPE)range: < 15.14-r1
- (no CPE)range: < 15.14-r1
- (no CPE)range: < 15.14-r1
- (no CPE)range: < 15.14-r0
- (no CPE)range: < 15.14-r1
- (no CPE)range: < 15.15-r0
- (no CPE)range: < 15.14-r1
- (no CPE)range: < 15.14-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 15.14-r1
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 15.14-r1
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 14.19-r1
- (no CPE)range: < 14.19-r0
- (no CPE)range: < 14.19-r0
- (no CPE)range: < 15.14-r0
- (no CPE)range: < 15.14-r1
- (no CPE)range: < 15.14-r1
- (no CPE)range: < 15.14-r1
- (no CPE)range: < 15.14-r0
- (no CPE)range: < 15.14-r1
- (no CPE)range: < 15.15-r0
- (no CPE)range: < 15.14-r1
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: < 16.3-r0
- (no CPE)range: >= 14.0.0, < 14.12.0
- (no CPE)range: < 16.0-1.module_el8.10.0+3798+606ebb9f
- (no CPE)range: < 1.4.8-1.module_el8.10.0+3798+606ebb9f
- (no CPE)range: < 2.4.0-1.Final.module_el8.10.0+3798+606ebb9f
- (no CPE)range: < 16.4-1.module_el8.10.0+3884+a79fbae6
- (no CPE)range: < 16.4-1.module_el8.10.0+3884+a79fbae6
- (no CPE)range: < 16.4-1.module_el8.10.0+3884+a79fbae6
- (no CPE)range: < 16.4-1.module_el8.10.0+3884+a79fbae6
- (no CPE)range: < 16.4-1.module_el8.10.0+3884+a79fbae6
- (no CPE)range: < 16.4-1.module_el8.10.0+3884+a79fbae6
- (no CPE)range: < 16.4-1.module_el8.10.0+3884+a79fbae6
- (no CPE)range: < 16.4-1.module_el8.10.0+3884+a79fbae6
- (no CPE)range: < 16.4-1.module_el8.10.0+3884+a79fbae6
- (no CPE)range: < 16.4-1.module_el8.10.0+3884+a79fbae6
- (no CPE)range: < 16.4-1.module_el8.10.0+3884+a79fbae6
- (no CPE)range: < 16.4-1.module_el8.10.0+3884+a79fbae6
- (no CPE)range: < 16.4-1.module_el8.10.0+3884+a79fbae6
- (no CPE)range: < 16.4-1.module_el8.10.0+3884+a79fbae6
- (no CPE)range: < 16.4-1.module_el8.10.0+3884+a79fbae6
- (no CPE)range: < 14.12-150200.5.44.1
- (no CPE)range: < 14.12-150600.16.3.1
- (no CPE)range: < 14.12-1.1
- (no CPE)range: < 15.7-150200.5.27.1
- (no CPE)range: < 15.7-150600.16.3.1
- (no CPE)range: < 15.7-1.1
- (no CPE)range: < 16.3-150200.5.13.1
- (no CPE)range: < 16.2-150600.16.2.1
- (no CPE)range: < 16.3-1.1
- (no CPE)range: < 16.3-150200.5.13.1
- (no CPE)range: < 14.12-150200.5.44.1
- (no CPE)range: < 14.12-150600.16.3.1
- (no CPE)range: < 14.12-150200.5.44.1
- (no CPE)range: < 14.12-150600.16.3.1
- (no CPE)range: < 14.12-3.41.1
- (no CPE)range: < 14.12-3.41.1
- (no CPE)range: < 14.12-3.41.1
- (no CPE)range: < 15.7-150200.5.27.1
- (no CPE)range: < 15.7-150600.16.3.1
- (no CPE)range: < 15.7-150200.5.27.1
- (no CPE)range: < 15.7-3.25.1
- (no CPE)range: < 15.7-3.25.1
- (no CPE)range: < 15.7-3.25.1
- (no CPE)range: < 16.3-150200.5.13.1
- (no CPE)range: < 16.2-150600.16.2.1
- (no CPE)range: < 16.3-150200.5.13.1
- (no CPE)range: < 16.4-150600.16.5.1
- (no CPE)range: < 16.3-150200.5.13.1
- (no CPE)range: < 16.2-150600.16.2.1
- (no CPE)range: < 16.3-3.13.1
- (no CPE)range: < 16.3-3.13.1
- (no CPE)range: < 16.3-3.13.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.