PostgreSQL Row Security Policy Bypass Vulnerability in Multiple Versions
Summary
UBUNTU-CVE-2024-10976: Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. Affects postgresql-9.3 versions 9.3.1-1 – 9.3.9-0ubuntu0.14.04. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database system that uses and extends the SQL language. It is known for its reliability, robustness, and performance. The affected versions of PostgreSQL include 9.3, 9.5, 10, 12, 14, and 16, which have a vulnerability related to incomplete tracking of tables with row security. This vulnerability allows unauthorized access to data by potentially applying incorrect policies when queries are reused across different roles.
Vulnerability Detail
The vulnerability, identified as CVE-2024-10976, arises from incomplete tracking in PostgreSQL of tables with row security. This flaw allows a reused query to view or change rows that were not intended, leading to incorrect application of role-specific policies. The issue is particularly concerning in scenarios involving security definer functions or when a common user and query are initially planned and then reused across multiple SET ROLEs. Attackers can exploit this vulnerability to gain unauthorized access to sensitive data, provided they tailor their attack to the specific application's query plan reuse and role-specific policies. Versions prior to PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider reviewing and modifying your row security policies to limit the exposure of sensitive data. Additionally, avoid reusing queries across different roles until the patch is applied. Implementing stricter access controls and monitoring can also help mitigate the risk until a fix is in place.
Conclusion
The PostgreSQL vulnerability CVE-2024-10976 poses a significant risk by allowing unauthorized access to data through incorrect application of row security policies. It is crucial to update to the latest patched versions of PostgreSQL to mitigate this risk and ensure the integrity of your database security.
See every vulnerability recorded for postgresql-9.3 →
FAQ
CVE-2024-10976 is a vulnerability in PostgreSQL that allows unauthorized access to data due to incomplete tracking of row security policies.
The affected versions include PostgreSQL 9.3, 9.5, 10, 12, 14, and 16, specifically those prior to the patched versions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability may allow attackers to access or modify data that they should not have permission to, leading to data breaches or unauthorized changes.
Yes, you can review and adjust your row security policies and avoid reusing queries across different roles until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-9.3.
