PT-2024-8140 · Postgresql+11 · Postgresql+11
Tom Lane
·
Published
2024-11-14
·
Updated
2026-04-03
·
CVE-2024-10978
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
PostgreSQL versions prior to 17.1
PostgreSQL versions prior to 16.5
PostgreSQL versions prior to 15.9
PostgreSQL versions prior to 14.14
PostgreSQL versions prior to 13.17
PostgreSQL versions prior to 12.21
Description:
The issue arises from incorrect privilege assignment, allowing a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem occurs when an application query uses parameters from the attacker or conveys query results to the attacker, and reacts to
current setting('role') or the current user ID. This may cause the query to modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies.Recommendations:
For versions prior to 17.1, update to PostgreSQL 17.1 or later.
For versions prior to 16.5, update to PostgreSQL 16.5 or later.
For versions prior to 15.9, update to PostgreSQL 15.9 or later.
For versions prior to 14.14, update to PostgreSQL 14.14 or later.
For versions prior to 13.17, update to PostgreSQL 13.17 or later.
For versions prior to 12.21, update to PostgreSQL 12.21 or later.
As a temporary workaround, consider restricting the use of SET ROLE and SET SESSION AUTHORIZATION features until a patch is available. Avoid using parameters from untrusted sources in application queries, and ensure that query results are not conveyed to attackers.
Fix
Incorrect Privilege Assignment
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Postgresql
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Zvirt Node