Critical Security Flaws in PostgreSQL: Important Update Required
Summary
ALSA-2024:10791: Important: postgresql security update. Affects postgresql versions < 13.18-1.el9_5. Fixed in 13.18-1.el9_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and compliance with SQL standards. It supports a wide range of data types and offers powerful features such as transactions, subselects, triggers, and views. However, recent vulnerabilities have been identified that could compromise the security of PostgreSQL installations, particularly in version 13.18 and earlier.
Vulnerability Detail
The vulnerabilities identified in PostgreSQL include: 1) CVE-2024-10978, which allows the SET ROLE and SET SESSION AUTHORIZATION commands to reset to an incorrect user ID, potentially leading to unauthorized access; 2) CVE-2024-10979, where changes to PL/Perl environment variables can execute arbitrary code, posing a significant security risk; and 3) CVE-2024-10976, which allows row security policies to disregard user ID changes in subqueries, potentially exposing sensitive data. These vulnerabilities can lead to unauthorized data access and execution of malicious code.
How To Fix
Minimum fixed version
13.18-1.el9_5
This is the first release that contains the fix.
sudo dnf update postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of the affected commands (SET ROLE and SET SESSION AUTHORIZATION) and avoid executing PL/Perl scripts until the update is applied. Additionally, review and adjust row security policies to ensure they are not bypassed.
Conclusion
In summary, PostgreSQL has critical vulnerabilities that require immediate attention through updates to the patched version. Users should be aware of the potential risks and take necessary precautions until the updates are applied. Utilizing tools like Vulert can aid in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for postgresql →
FAQ
The main vulnerabilities include incorrect user ID resets, arbitrary code execution via environment variable changes, and row security policy bypasses.
You can check your PostgreSQL version using the command 'SELECT version();' and compare it with the patched version 13.18-1.el9_5.
If you cannot update immediately, limit the use of affected commands and review your row security policies as a temporary measure.
More information can be found on the CVE pages for CVE-2024-10976, CVE-2024-10978, and CVE-2024-10979.
Vulert monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json, without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
