EXECUTIVE SUMMARY:
A high-severity vulnerability, CVE-2024-10979, has been disclosed in the PostgreSQL open-source database system that allows unprivileged users to alter environment variables, potentially leading to arbitrary code execution or information disclosure. The flaw arises due to incorrect control of environment variables in PostgreSQL's PL/Perl, enabling attackers to modify sensitive process environment variables such as PATH. This issue could allow an attacker to execute arbitrary code, even without access to the database server operating system user, or extract valuable machine information by running malicious queries. To mitigate the risk, users are advised to update to the fixed versions and restrict allowed extensions by enforcing proper permissions, including limiting CREATE EXTENSIONS and CREATE FUNCTION permissions, and configuring the shared_preload_libraries parameter to load only necessary extensions. Additionally, users are urged to follow the principle of least privilege when configuring database roles and permissions.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
A high-severity vulnerability, CVE-2024-10979, has been disclosed in the PostgreSQL open-source database system that allows unprivileged users to alter environment variables, potentially leading to arbitrary code execution or information disclosure. The flaw arises due to incorrect control of environment variables in PostgreSQL's PL/Perl, enabling attackers to modify sensitive process environment variables such as PATH. This issue could allow an attacker to execute arbitrary code, even without access to the database server operating system user, or extract valuable machine information by running malicious queries. To mitigate the risk, users are advised to update to the fixed versions and restrict allowed extensions by enforcing proper permissions, including limiting CREATE EXTENSIONS and CREATE FUNCTION permissions, and configuring the shared_preload_libraries parameter to load only necessary extensions. Additionally, users are urged to follow the principle of least privilege when configuring database roles and permissions.[emaillocker id="1283"]
RECOMMENDATION:
REFERENCES:
The following reports contain further technical details:
https://thehackernews.com/2024/11/high-severity-flaw-in-postgresql-allows.html