PT-2024-5504 · Unknown+12 · Postgresql+11
Noah Misch
·
Published
2024-08-07
·
Updated
2026-04-03
·
CVE-2024-7348
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
PostgreSQL versions prior to 16.4
PostgreSQL versions prior to 15.8
PostgreSQL versions prior to 14.13
PostgreSQL versions prior to 13.16
PostgreSQL versions prior to 12.20
Description
A Time-of-check Time-of-use (TOCTOU) race condition in pg dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Approximately 3,929,844 devices are potentially affected, mainly distributed in the United States, Germany, and other countries.
Recommendations
For versions prior to 16.4, upgrade to version 16.4 or later.
For versions prior to 15.8, upgrade to version 15.8 or later.
For versions prior to 14.13, upgrade to version 14.13 or later.
For versions prior to 13.16, upgrade to version 13.16 or later.
For versions prior to 12.20, upgrade to version 12.20 or later.
As a temporary workaround, consider restricting access to the pg dump utility until a patch is available. Avoid using the pg dump utility with open transactions to minimize the risk of exploitation.
Fix
Time Of Check To Time Of Use
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Postgresql
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Zvirt Node