CVE-2024-10979
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | PostgreSQL | 17 < 17.1 | affected |
| n/a | PostgreSQL | 16 < 16.5 | affected |
| n/a | PostgreSQL | 15 < 15.9 | affected |
| n/a | PostgreSQL | 14 < 14.14 | affected |
| n/a | PostgreSQL | 13 < 13.17 | affected |
| n/a | PostgreSQL | 0 < 12.21 | affected |
Weaknesses
- CWE-15: External Control of System or Configuration Setting
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
CVE Program Container
Additional References
- https://github.com/fmora50591/postgresql-env-vuln/blob/main/README.md
- https://security.netapp.com/advisory/ntap-20250110-0003/
- https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.