PT-2024-18244 · Plv8 · Plv8

Pedroga-G · Published 2024-03-14 · Updated 2025-01-23 · CVE-2024-1713

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions plv8 version 3.2.1

Description A user who can create objects in a database with plv8 installed is able to cause deferred triggers to execute as the Superuser during autovacuum.

Recommendations For plv8 version 3.2.1, consider restricting access to create objects in the database until a patch is available. As a temporary workaround, consider disabling the execution of deferred triggers during autovacuum to minimize the risk of exploitation.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

CWE-394

Related Identifiers

CVE-2024-1713

GHSA-R7M9-GRW7-VCC4

Affected Products

Plv8

References · 10

• 🔥 https://github.com/google/security-research/security/advisories/GHSA-r7m9-grw7-vcc4 · Exploit
• https://cve.org/CVERecord?id=CVE-2024-1713 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-1713 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1713 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-1713 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-1713 · Vendor Advisory
• https://twitter.com/CVEnew/status/1768373359799042185 · Twitter Post
• https://t.me/cvenotify/73842 · Telegram Post
• https://t.me/cvenotify/73906 · Telegram Post
• https://t.me/cvenotify/108407 · Telegram Post