The vulnerability CVE-2024-4317 in PostgreSQL involves missing authorization checks in the built-in views pg_stats_ext and pg_stats_ext_exprs. This flaw permits unprivileged database users to access statistical information, such as most common values derived from CREATE STATISTICS commands, belonging to other users. Such data exposure can leak sensitive column values or function results that would otherwise be inaccessible. The issue affects PostgreSQL major versions 14, 15, and 16 before the minor releases 14.12, 15.7, and 16.3 respectively. Installing an unaffected version only secures fresh PostgreSQL installations created after the update; existing installations remain vulnerable until they apply the vendor's remediation steps. The vulnerability is tracked under CVE-2024-4317 and is rated medium severity by Red Hat Product Security. A patch is available, and detailed remediation instructions are provided by Red Hat.

Unprivileged database users can read statistical data from other users' CREATE STATISTICS commands via the vulnerable views. This may disclose sensitive column values or function results that the user is not authorized to access, potentially leading to information leakage within the database environment. The vulnerability does not allow direct modification or execution of arbitrary code but compromises data confidentiality.

A patch is available for this vulnerability. Users should upgrade PostgreSQL to versions 14.12 or later, 15.7 or later, and 16.3 or later to remediate the issue. For existing PostgreSQL installations, simply installing the updated version is insufficient; administrators must follow the specific instructions in the PostgreSQL release notes and Red Hat advisory RHSA-2024:5927 to fully mitigate the vulnerability. Refer to https://access.redhat.com/articles/11258 for detailed update and remediation guidance.