This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] PostgreSQL fixes 4 vulnerabilities

PostgreSQL versions 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 fix 4 vulnerabilities. Version 12 will no longer be supported, so migration to newer versions of the product is recommended [1].

PostgreSQL - RCE (CVE-2024-10979)
CVSS 8.8 (High)

Allows an authenticated remote attacker, due to incorrect control of environment variables in PostgreSQL PL/Perl, to change sensitive environment variables (e.g. PATH), which may lead to code execution on the database server without the attacker having access to the server's operating system [2].

The vulnerability is present in product:

  • PostgreSQL; >=12.0, <12.21; >=13.0, <13.17; >=14.0, <14.14; >=15.0, <15.9; >=16.0, <16.5; >=17.0, <17.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 11. 2024.

PostgreSQL - unauthorized data manipulation (CVE-2024-10978)
CVSS 4.2 (Medium)

Allows an authenticated remote attacker, through incorrect privilege assignment using the commands "SET ROLE", "SET SESSION AUTHORIZATION" or similar functions, to view or modify database rows without authorization [3].

The vulnerability is present in product:

  • PostgreSQL; >=12.0, <12.21; >=13.0, <13.17; >=14.0, <14.14; >=15.0, <15.9; >=16.0, <16.5; >=17.0, <17.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

More information:

The vulnerability was publicly disclosed 14. 11. 2024.

PostgreSQL - unauthorized data manipulation (CVE-2024-10976)
CVSS 4.2 (Medium)

Allows an authenticated remote attacker, in tables with row-level security, due to incomplete tracking of user ID changes, to view or modify database rows without authorization. The vulnerability is exploitable in applications using subqueries, "WITH" queries, "Security Invoker View" or SQL functions referencing tables with this protection [4].

The vulnerability is present in product:

  • PostgreSQL; >=12.0, <12.21; >=13.0, <13.17; >=14.0, <14.14; >=15.0, <15.9; >=16.0, <16.5; >=17.0, <17.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

More information:

  • CVE-2024-10976 at cve.org, NVD
  • CWE-1250: Improper Preservation of Consistency Between Independent Representations of Shared State at cwe.mitre.org

The vulnerability was publicly disclosed 14. 11. 2024.

PostgreSQL - false query results (CVE-2024-10977)
CVSS 3.1 (Low)

Allows an authenticated remote attacker, by passing arbitrary non-NUL bytes to the libpq application, to inject fake error messages that the user may consider a valid query result [5].

The vulnerability is present in product:

  • PostgreSQL; >=12.0, <12.21; >=13.0, <13.17; >=14.0, <14.14; >=15.0, <15.9; >=16.0, <16.5; >=17.0, <17.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

More information:

The vulnerability was publicly disclosed 14. 11. 2024.

By CESNET, z.s.p.o. Michaela Ručková on 18. 11. 2024.

CESNET, z.s.p.o. Logo