PostgreSQL: pg_ivm 1.5.1 Security update release

[NewsBot]

A new PostgreSQL blog post/announcement has been posted!

IVM Development Group have released pg_ivm 1.5.1 to address security issues: CVE-2023-22847, CVE-2023-23554.

Security issues

• Exposure of sensitive information to an unauthorized actor (CWE-200) - CVE-2023-22847 An Incrementally Maintainable Materialized View (IMMV) created by pg_ivm may reflect rows with Row-Level Security that the owner of the IMMV should not have access to.

• Uncontrolled search path element (CWE-427) - CVE-2023-23554 When refreshing an IMMV, pg_ivm executes functions without specifying schema names. Under certain conditions, pg_ivm may be tricked to execute unexpected functions from other schemas with the IMMV owner's privilege.

Bug fixes

• Fix row level security checks during view main...

Get the full details here: PostgreSQL: pg_ivm 1.5.1 Security update release

[bot]

Corresponding tweet for this thread:

Devtalk

Share link for this tweet.