Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2024-10979

PostgreSQL PL/Perl environment variable changes execute arbitrary code

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
PostgreSQL

Description

Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a PostgreSQL

Default version status: unaffected

  • 17 to < 17.1affected
  • 16 to < 16.5affected
  • 15 to < 15.9affected
  • 14 to < 14.14affected
  • 13 to < 13.17affected
  • 0 to < 12.21affected

References