PT-2024-8138 · Postgresql+11 · Postgresql+11
Fabian Mora
+1
·
Published
2024-11-14
·
Updated
2026-04-03
·
CVE-2024-10979
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
PostgreSQL versions prior to 17.1
PostgreSQL versions prior to 16.5
PostgreSQL versions prior to 15.9
PostgreSQL versions prior to 14.14
PostgreSQL versions prior to 13.17
PostgreSQL versions prior to 12.21
Description:
The issue is related to incorrect control of environment variables in PostgreSQL PL/Perl, allowing an unprivileged database user to change sensitive process environment variables, such as
PATH. This can enable arbitrary code execution, even if the attacker lacks a database server operating system user. The vulnerability can be exploited by altering environment variables, potentially leading to code execution or information leaks.Recommendations:
Update to version 17.1 or later to resolve the issue.
Update to version 16.5 or later to resolve the issue.
Update to version 15.9 or later to resolve the issue.
Update to version 14.14 or later to resolve the issue.
Update to version 13.17 or later to resolve the issue.
Update to version 12.21 or later to resolve the issue.
As a temporary workaround, consider restricting access to the PL/Perl extension until a patch is available.
Limit extensions and use least privilege to minimize the risk of exploitation.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Postgresql
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Zvirt Node