topic Re: CVE-2024-0985 - PostgreSQL security bypass vulnerability in ArcGIS Monitor Questions

CVE-2024-0985 - PostgreSQL security bypass vulnerability

KikSiops — Wed, 24 Apr 2024 03:14:03 GMT

Hi ,

A vulnerability has been identified in PostgreSQL for which I have been identified as the owner. Can someone assist us to please determine if this system is vulnerable and complete remediation?

Vulnerability Name:CVE-2024-0985 - PostgreSQL security bypass vulnerability

We would like to ask for assistance on how to remediate this?

Affected servers are our ArcGIS Monitors.

Thanks in advanced 😊

Re: CVE-2024-0985 - PostgreSQL security bypass vulnerability

MarceloMarques — Wed, 24 Apr 2024 04:06:39 GMT

@KikSiops

If it is a PostgreSQL vulnerability, then install the latest PostgreSQL update.

PostgreSQL: CVE-2024-0985: PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL

I explain how to patch PostgreSQL in the white papers below.

How to Upgrade the PostgreSQL and PostGIS version for the Enterprise Geodatabase on Windows
How to Upgrade the PostgreSQL and PostGIS version for the Enterprise Geodatabase on Linux

I hope this clarifies.

Re: CVE-2024-0985 - PostgreSQL security bypass vulnerability

DerekLaw — Thu, 25 Apr 2024 19:05:05 GMT

Hi @KikSiops,

In future, I would ask that you please contact Esri Tech Support directly with possible security vulnerability questions. It is company policy to address these concerns directly with customers to ensure correct and accurate information is communicated. Other reasons: to avoid potential false alarms and to avoid advertising/promoting a potential security issue.

A good resource to be aware of the the ArcGIS Trust Site: https://trust.arcgis.com/en/

Hope this helps,