CVE-2024-10979
PostgreSQL PL/Perl environment variable changes execute arbitrary code
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
PostgreSQL PL/Perl environment variable changes execute arbitrary code
Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
Reserved 2024-11-07 | Published 2024-11-14 | Updated 2024-11-25 | Assigner PostgreSQLExternal Control of System or Configuration Setting
The PostgreSQL project thanks Coby Abrams for reporting this problem.
www.postgresql.org/support/security/CVE-2024-10979/
Support options
