Critical Security Update for PostgreSQL: Addressing Multiple Vulnerabilities
Summary
ALSA-2024:10832: Important: postgresql:13 security update. Affects pg_repack across 2 version ranges.
< 1.4.6-3.module_el8.6.0+2760+1746ec94
< 1.4.6-3.module_el8.9.0+3704+f1f917ce
Fixed in 1.4.6-3.module_el8.6.0+2760+1746ec94 or 1.4.6-3.module_el8.9.0+3704+f1f917ce, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and compliance with SQL standards. It supports a wide range of data types and offers powerful features such as transactions, subselects, triggers, views, and stored procedures. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing PostgreSQL, particularly affecting the SET ROLE and PL/Perl functionalities.
Vulnerability Detail
The vulnerabilities identified in PostgreSQL include CVE-2024-10978, which allows the SET ROLE and SET SESSION AUTHORIZATION commands to reset to an incorrect user ID, potentially leading to unauthorized access. CVE-2024-10979 highlights an issue where changes to environment variables in PL/Perl can execute arbitrary code, posing a severe risk of code injection. Additionally, CVE-2024-10976 reveals that row security policies may disregard user ID changes in subqueries, leading to unintended data exposure. These vulnerabilities stem from flaws in the handling of user roles and security policies, which could be exploited by malicious actors.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update pg_repack-
< 1.4.6-3.module_el8.6.0+2760+1746ec941.4.6-3.module_el8.6.0+2760+1746ec94 -
< 1.4.6-3.module_el8.9.0+3704+f1f917ce1.4.6-3.module_el8.9.0+3704+f1f917ce
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can restrict access to the affected functionalities by modifying user roles and permissions until the update can be applied. It is advisable to review and tighten security policies related to user roles and environment variables in PL/Perl scripts.
Conclusion
The recent vulnerabilities in PostgreSQL pose significant risks to database security, necessitating immediate attention and remediation. By updating to the latest patched versions and implementing strict access controls, users can protect their systems from potential exploitation. Utilizing tools like Vulert can further enhance security monitoring and vulnerability management.
See every vulnerability recorded for pg_repack →
FAQ
The vulnerabilities can lead to unauthorized access, arbitrary code execution, and data exposure, compromising the integrity and confidentiality of the database.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If immediate updates are not possible, implement strict access controls and review user roles and permissions to mitigate potential risks.
While specific exploits may not be publicly available, the nature of the vulnerabilities suggests that they could be exploited by attackers familiar with PostgreSQL's role management and PL/Perl functionalities.
Detailed information can be found on the CVE pages for CVE-2024-10976, CVE-2024-10978, and CVE-2024-10979, as well as the official PostgreSQL security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
