Description
Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
Metrics
CVSS 3.1 8.8/10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | PostgreSQL | >= 17, < 17.1; >= 16, < 16.5; >= 15, < 15.9; >= 14, < 14.14; >= 13, < 13.17; < 12.21 |
| postgresql | postgresql | < 12.21; >= 13, < 13.17; >= 14, < 14.14; >= 15, < 15.9; >= 16, < 16.5; >= 17, < 17.1 |
References
- https://www.postgresql.org/support/security/CVE-2024-10979/Vendor Advisory
- https://github.com/fmora50591/postgresql-env-vuln/blob/main/README.mdExploit, Mitigation, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html
- https://security.netapp.com/advisory/ntap-20250110-0003/Third Party Advisory
Timeline
- Published
- Nov 14, 2024
- Last modified
- Jun 17, 2026
- NVD status
- Modified