This advisory covers two security vulnerabilities in PostgreSQL 15 as packaged by Red Hat. CVE-2024-7348 involves the execution of arbitrary SQL during relation replacement in the pg_dump utility, potentially allowing unintended SQL commands to run. CVE-2024-4317 concerns missing authorization checks in the pg_stats_ext and pg_stats_ext_exprs system views, which could allow unauthorized access to extended statistics data. Red Hat has released an update for these issues in Red Hat Enterprise Linux 9 and related distributions. The advisory references CVE pages for detailed impact and scoring information but does not provide CVSS scores directly. The update is classified as important and users should ensure all prior errata are applied before updating.

The vulnerabilities allow for unauthorized SQL execution and bypass of authorization checks within PostgreSQL 15, potentially leading to unauthorized data access or modification. The issues affect the pg_dump utility and system statistics views, which could be leveraged by attackers with access to the database to perform unauthorized actions. Red Hat rates the security impact as important, indicating a high severity level but not critical. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update for PostgreSQL 15 addressing these vulnerabilities. Users should apply the update as provided by Red Hat Enterprise Linux 9 errata. Before applying this update, ensure that all previously released relevant errata are installed. Follow Red Hat's documented procedures for updating PostgreSQL packages. No additional mitigation steps are indicated beyond applying the official patch.