{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-10979", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2024-11-07T19:27:04.476Z", "datePublished": "2024-11-14T13:00:08.586Z", "dateUpdated": "2024-11-25T04:40:58.782Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2024-11-14T13:00:08.586Z"}, "title": "PostgreSQL PL/Perl environment variable changes execute arbitrary code", "descriptions": [{"lang": "en", "value": "Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected."}], "affected": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "17.1", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.5", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.9", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.14", "status": "affected", "version": "14", "versionType": "rpm"}, {"lessThan": "13.17", "status": "affected", "version": "13", "versionType": "rpm"}, {"lessThan": "12.21", "status": "affected", "version": "0", "versionType": "rpm"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-15", "type": "CWE", "description": "External Control of System or Configuration Setting"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2024-10979/"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "configurations": [{"lang": "en", "value": "administrator has installed PL/Perl"}, {"lang": "en", "value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"}], "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Coby Abrams for reporting this problem."}]}, "adp": [{"affected": [{"vendor": "postgresql", "product": "postgresql", "cpes": ["cpe:2.3:a:postgresql:postgresql:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "12.21", "versionType": "rpm"}, {"version": "13", "status": "affected", "lessThan": "13.17", "versionType": "rpm"}, {"version": "14", "status": "affected", "lessThan": "14.14", "versionType": "rpm"}, {"version": "15", "status": "affected", "lessThan": "15.9", "versionType": "rpm"}, {"version": "16", "status": "affected", "lessThan": "16.5", "versionType": "rpm"}, {"version": "17", "status": "affected", "lessThan": "17.1", "versionType": "rpm"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-20T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-10979"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-21T04:55:16.916Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-11-25T04:40:58.782Z"}, "references": [{"url": "https://github.com/fmora50591/postgresql-env-vuln/blob/main/README.md"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/fmora50591/postgresql-env-vuln/blob/main/README.md"}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-11-25T04:40:58.782Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-10979", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-14T14:32:36.606857Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:postgresql:postgresql:-:*:*:*:*:*:*:*"], "vendor": "postgresql", "product": "postgresql", "versions": [{"status": "affected", "version": "0", "lessThan": "12.21", "versionType": "rpm"}, {"status": "affected", "version": "13", "lessThan": "13.17", "versionType": "rpm"}, {"status": "affected", "version": "14", "lessThan": "14.14", "versionType": "rpm"}, {"status": "affected", "version": "15", "lessThan": "15.9", "versionType": "rpm"}, {"status": "affected", "version": "16", "lessThan": "16.5", "versionType": "rpm"}, {"status": "affected", "version": "17", "lessThan": "17.1", "versionType": "rpm"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-14T14:36:25.467Z"}}], "cna": {"title": "PostgreSQL PL/Perl environment variable changes execute arbitrary code", "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Coby Abrams for reporting this problem."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "n/a", "product": "PostgreSQL", "versions": [{"status": "affected", "version": "17", "lessThan": "17.1", "versionType": "rpm"}, {"status": "affected", "version": "16", "lessThan": "16.5", "versionType": "rpm"}, {"status": "affected", "version": "15", "lessThan": "15.9", "versionType": "rpm"}, {"status": "affected", "version": "14", "lessThan": "14.14", "versionType": "rpm"}, {"status": "affected", "version": "13", "lessThan": "13.17", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "12.21", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2024-10979/"}], "descriptions": [{"lang": "en", "value": "Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-15", "description": "External Control of System or Configuration Setting"}]}], "configurations": [{"lang": "en", "value": "administrator has installed PL/Perl"}, {"lang": "en", "value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2024-11-14T13:00:08.586Z"}}}, "cveMetadata": {"cveId": "CVE-2024-10979", "state": "PUBLISHED", "dateUpdated": "2024-11-25T04:40:58.782Z", "dateReserved": "2024-11-07T19:27:04.476Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2024-11-14T13:00:08.586Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected."}, {"lang": "es", "value": "El control incorrecto de las variables de entorno en PostgreSQL PL/Perl permite que un usuario de base de datos sin privilegios modifique variables de entorno de proceso sensibles (por ejemplo, PATH). Esto suele ser suficiente para permitir la ejecuci\u00f3n de c\u00f3digo arbitrario, incluso si el atacante no tiene un usuario del sistema operativo del servidor de base de datos. Las versiones anteriores a PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17 y 12.21 se ven afectadas."}], "id": "CVE-2024-10979", "lastModified": "2024-11-25T05:15:08.710", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}, "published": "2024-11-14T13:15:04.407", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://www.postgresql.org/support/security/CVE-2024-10979/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/fmora50591/postgresql-env-vuln/blob/main/README.md"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-15"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2024:10882", "cpe": "cpe:/o:redhat:rhel_els:7", "package": "postgresql-0:9.2.24-9.el7_9.2", "product_name": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "release_date": "2024-12-09T00:00:00Z"}, {"advisory": "RHSA-2024:10785", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "postgresql:12-8100020241122084405.489197e6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-12-04T00:00:00Z"}, {"advisory": "RHSA-2024:10830", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "postgresql:15-8100020241122084744.489197e6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10831", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "postgresql:16-8100020241122085009.489197e6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10832", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "postgresql:13-8100020241122084628.489197e6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10739", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "postgresql:12-8020020241126122642.4cda2c84", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2024-12-03T00:00:00Z"}, {"advisory": "RHSA-2024:10789", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "postgresql:12-8040020241129070850.522a0ee4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2024-12-04T00:00:00Z"}, {"advisory": "RHSA-2024:10846", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "postgresql:13-8040020241127111253.522a0ee4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10789", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "postgresql:12-8040020241129070850.522a0ee4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2024-12-04T00:00:00Z"}, {"advisory": "RHSA-2024:10846", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "postgresql:13-8040020241127111253.522a0ee4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10789", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "postgresql:12-8040020241129070850.522a0ee4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2024-12-04T00:00:00Z"}, {"advisory": "RHSA-2024:10846", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "postgresql:13-8040020241127111253.522a0ee4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10677", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "postgresql:13-8060020241128071428.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-12-02T00:00:00Z"}, {"advisory": "RHSA-2024:10705", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "postgresql:12-8060020241128124027.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-12-02T00:00:00Z"}, {"advisory": "RHSA-2024:10677", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "postgresql:13-8060020241128071428.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-12-02T00:00:00Z"}, {"advisory": "RHSA-2024:10705", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "postgresql:12-8060020241128124027.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-12-02T00:00:00Z"}, {"advisory": "RHSA-2024:10677", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "postgresql:13-8060020241128071428.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-12-02T00:00:00Z"}, {"advisory": "RHSA-2024:10705", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "postgresql:12-8060020241128124027.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-12-02T00:00:00Z"}, {"advisory": "RHSA-2024:10750", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "postgresql:12-8080020241128093923.63b34585", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-12-03T00:00:00Z"}, {"advisory": "RHSA-2024:10800", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "postgresql:13-8080020241201154729.63b34585", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-12-04T00:00:00Z"}, {"advisory": "RHSA-2024:10851", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "postgresql:15-8080020241201160004.63b34585", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10787", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "postgresql:15-9050020241122141928.rhel9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-12-04T00:00:00Z"}, {"advisory": "RHSA-2024:10788", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "postgresql:16-9050020241122142517.rhel9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-12-04T00:00:00Z"}, {"advisory": "RHSA-2024:10791", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "postgresql-0:13.18-1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-12-04T00:00:00Z"}, {"advisory": "RHSA-2024:10827", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "postgresql-0:13.18-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10807", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "postgresql:15-9020020241122142614.rhel9", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-12-04T00:00:00Z"}, {"advisory": "RHSA-2024:10879", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "postgresql-0:13.18-1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-12-09T00:00:00Z"}, {"advisory": "RHSA-2024:10593", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "postgresql:16-9040020241125115314.rhel9", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2024-12-02T00:00:00Z"}, {"advisory": "RHSA-2024:10595", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "postgresql-0:13.18-1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2024-12-02T00:00:00Z"}, {"advisory": "RHSA-2024:10736", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "postgresql:15-9040020241121160342.rhel9", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2024-12-03T00:00:00Z"}], "bugzilla": {"description": "postgresql: PostgreSQL PL/Perl environment variable changes execute arbitrary code", "id": "2326253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2326253"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-15", "details": ["Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.", "A flaw was found in PostgreSQL PL/Perl. This vulnerability allows an unprivileged database user to change sensitive process environment variables (e.g., PATH) via incorrect control of environment variables."], "mitigation": {"lang": "en:us", "value": "Currently the following options exist to help mitigate the impact of this vulnerability: \n1) Restrict Permissions: the creation of PL/Python and PL/Perl functions should be limited to trusted users only. \n2) Environment Variable Sanitization: ensure that environment variables are properly sanitized and any modifications are restricted.\n3) Upgrade PostgreSQL: if a fix is released by the PostgreSQL Global Development Group, update to the latest version.\n4) Audit Database Functions: perform regular audits on user-created functions to detect and prevent potential exploitation."}, "name": "CVE-2024-10979", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "postgresql", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2024-11-14T13:00:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-10979\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-10979\nhttps://www.postgresql.org/support/security/CVE-2024-10979/"], "statement": "This vulnerability has been given a severity rating of important because the ability to modify sensitive process environment variables (ex. PATH) can lead to unauthorized code execution and privilege escalation. Depending on the privileges of the PostgreSQL user, an attacker may be able to gain higher-level access to the underlying server and create functions who modify environment variables and execute arbitrary commands.", "threat_severity": "Important"}