This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] PostgreSQL fixes 1 vulnerability
PostgreSQL fixes 1 vulnerability and several bugs that were not assigned a CVE identifier in versions 16.4, 15.8, 14.13, 13.16 and 12.20. Details can be found at [1].
An authenticated remote attacker with permissions to create and drop permanent objects can carry out an SQL injection attack, with the code being executed with the privileges of the "pg_dump" process (usually a superuser). To prevent exploitation of the vulnerability, both the machine from which the backup is created and the machine that creates the backup using the "pg_dump" tool must be updated to one of the fixed versions, and the parameter "restrict_nonsystem_relation_kind " must also be set correctly [1]. A description of this parameter can be found at [2].
The vulnerability is present in product:
- PostgreSQL; >=16, <16.4; >=15, <15.8; >=14, <14.13; >=13, <13.16; >=12, <12.20;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-7348 at cve.org, NVD
- CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition at cwe.mitre.org
The vulnerability was publicly disclosed 8. 8. 2024.
Links
By CESNET, z.s.p.o. Martin Krajči on 9. 8. 2024.