Important: PostgreSQL Security Update
Summary
ALSA-2024:5999: Important: postgresql security update. Affects postgresql versions < 13.16-1.el9_4. Fixed in 13.16-1.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS). It is widely used for storing and managing structured data in various applications. PostgreSQL offers a range of features and capabilities, including support for complex queries, data integrity, and extensibility. However, a security vulnerability has been identified in PostgreSQL that could potentially allow an attacker to execute arbitrary SQL commands during the pg_dump process, leading to unauthorized access or data manipulation.
Vulnerability Detail
The vulnerability, identified as CVE-2024-7348, involves the replacement of PostgreSQL relations during the pg_dump utility. This process, used for database backups, can be exploited by an attacker to execute arbitrary SQL commands. By manipulating the relation replacement, an attacker could gain unauthorized access to the database or modify its contents. The impact of this vulnerability can be severe, potentially leading to data breaches, unauthorized data manipulation, or privilege escalation.
How To Fix
Minimum fixed version
13.16-1.el9_4
This is the first release that contains the fix.
sudo dnf update postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is crucial to apply the security update as soon as possible to mitigate the risk of exploitation.
Conclusion
PostgreSQL users should promptly update their installations to the latest version to address the vulnerability. By applying the recommended security update, the risk of unauthorized access or data manipulation can be significantly reduced.
See every vulnerability recorded for postgresql →
FAQ
PostgreSQL is an advanced object-relational database management system known for its robustness, extensibility, and support for complex queries.
The vulnerability allows an attacker to execute arbitrary SQL commands during the pg_dump process, potentially leading to unauthorized access or data manipulation.
To fix this vulnerability, update PostgreSQL to version 13.16-1.el9_4 or later.
No specific workaround has been provided. It is recommended to apply the security update.
More information about this vulnerability can be found in the CVE page listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
