External Control of System or Configuration Setting (CWE-15)
Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). This vulnerability often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. The vulnerability affects versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21.
This vulnerability has a high severity with a CVSS base score of 8.8. It allows unprivileged database users to potentially execute arbitrary code on the database server. The attack vector is network-based, requires low attack complexity, and needs only low privileges to exploit. There is no user interaction required. The impact on confidentiality, integrity, and availability is high. This could lead to unauthorized access to sensitive data, manipulation of database contents, or disruption of database services.
There is no evidence that a public proof-of-concept exists. Its exploitation has been reported by various sources, including talkback.sh.
Patches are available. Users should upgrade to PostgreSQL versions 17.1, 16.5, 15.9, 14.14, 13.17, or 12.21 or later, depending on their current major version, to mitigate the vulnerability.
1. Update PostgreSQL to the latest patched versions: 17.1, 16.5, 15.9, 14.14, 13.17, or 12.21, depending on your current major version. 2. If immediate patching is not possible, consider restricting network access to the PostgreSQL server. 3. Review and limit the privileges of database users, especially their ability to interact with PL/Perl functions. 4. Monitor for any suspicious activities or unauthorized changes to environment variables, particularly PATH. 5. Implement the principle of least privilege for database users and roles. 6. Regularly audit PL/Perl functions and their usage within the database.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2024-10979. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-10979
A CVSS base score of 8.8 has been assigned.
CVE-2024-10979 is a critical vulnerability in the PostgreSQL PL/Perl environment that allows for the execution of arbitrary code through environment variable changes. The details regarding its exploitation in the wild, proof-of-concept exploits, mitigations, detections, patches, or downstream impacts on third-party vendors are not provided in the available information. Further investigation is necessary to assess the full scope and implications of this vulnerability. See article
EPSS Score was set to: 0.04% (Percentile: 10.2%)
Attacks in the wild have been reported by Talkback Tech. See article
This CVE started to trend in security discussions
Detection for the vulnerability has been added to Qualys (6016842)