CVE-2024-10979
14.11.2024, 13:15
Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.Enginsight
| Vendor | Product | Version |
|---|---|---|
| postgresql | postgresql | 12.0 ≤ 𝑥 < 12.21 |
| postgresql | postgresql | 13.0 ≤ 𝑥 < 13.17 |
| postgresql | postgresql | 14.0 ≤ 𝑥 < 14.14 |
| postgresql | postgresql | 15.0 ≤ 𝑥 < 15.9 |
| postgresql | postgresql | 16.0 ≤ 𝑥 < 16.5 |
| postgresql | postgresql | 17.0 ≤ 𝑥 < 17.1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| postgresql-10 |
| ||||||||||||
| postgresql-12 |
| ||||||||||||
| postgresql-14 |
| ||||||||||||
| postgresql-16 |
| ||||||||||||
| postgresql-17 |
| ||||||||||||
| postgresql-9.1 |
| ||||||||||||
| postgresql-9.3 |
| ||||||||||||
| postgresql-9.5 |
|
Common Weakness Enumeration
- CWE-15 - External Control of System or Configuration SettingOne or more system settings or configuration elements can be externally controlled by a user.
- CWE-610 - Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.