{"id":120577,"date":"2024-11-16T01:09:06","date_gmt":"2024-11-15T23:09:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-kod-s-pravami-rabochego-proczessa"},"modified":"2024-11-16T01:09:06","modified_gmt":"2024-11-15T23:09:06","slug":"uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-kod-s-pravami-rabochego-proczessa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-kod-s-pravami-rabochego-proczessa","title":{"rendered":"Eine Schwachstelle in PostgreSQL, die die Ausf\u00fchrung von Code mit Berechtigungen des Arbeitsprozesses erm\u00f6glicht.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Es wurden Korrekturupdates f\u00fcr alle unterst\u00fctzten Versionen von PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17 und 12.21 erstellt, die 35 Fehler beheben und 3 Sicherheitsanf\u00e4lligkeiten beseitigen \u2013 eine schwere und zwei weniger schwerwiegende. Au\u00dferdem wurde die Einstellung der Unterst\u00fctzung f\u00fcr die Version PostgreSQL 12 bekannt gegeben, f\u00fcr die keine weiteren Updates mehr erstellt werden. <\/p>\n

Die schwere Sicherheitsanf\u00e4lligkeit (CVE-2024-10979), die mit einem Gef\u00e4hrdungsgrad von 8,8 von 10 eingestuft wird, erm\u00f6glicht es einem lokalen DB-Benutzer, der \u00fcber Rechte zur Erstellung von PL\/Perl-Funktionen verf\u00fcgt, Code mit den Rechten des Benutzers auszuf\u00fchren, unter dem das DBMS l\u00e4uft. Die Sicherheitsanf\u00e4lligkeit entsteht dadurch, dass in PL\/Perl-Funktionen Umgebungsvariablen des Arbeitsprozesses, einschlie\u00dflich der PATH-Variable, die die Pfade zu ausf\u00fchrbaren Dateien definiert, sowie PostgreSQL-spezifische Umgebungsvariablen ge\u00e4ndert werden k\u00f6nnen. Es wird festgestellt, dass f\u00fcr einen Angriff lediglich der Zugriff auf das DBMS erforderlich ist und kein Benutzerkonto im System vorhanden sein muss. CREATE OR REPLACE FUNCTION plperl_set_env_var() RETURNS void AS $$ $ENV{\u2018ENV_VAR\u2019} = \u2018testval\u2019; $$ LANGUAGE plperl; SELECT plperl_set_env_var();
\n
Quelle: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17 \u0438 12.21, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b 35 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 3 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 — \u043e\u0434\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0438 \u0434\u0432\u0435 \u043d\u0435\u043e\u043f\u0430\u0441\u043d\u044b\u0445. \u0422\u0430\u043a\u0436\u0435 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u043e \u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0432\u0435\u0442\u043a\u0438 PostgreSQL 12, \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u043e\u043b\u044c\u0448\u0435 \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0435 \u0431\u0443\u0434\u0443\u0442. \u041e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-10979), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 8.8 \u0438\u0437 10, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120577","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Sicherheitsanf\u00e4lligkeit in PostgreSQL erm\u00f6glicht das Ausf\u00fchren von Code mit den Rechten des Arbeitsprozesses | ProHoster","description":"Es wurden Korrekturupdates f\u00fcr alle unterst\u00fctzten Versionen von PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17 und 12.21 erstellt, in denen 35 Fehler behoben und 3 Sicherheitsanf\u00e4lligkeiten - eine kritische und zwei weniger kritische - beseitigt wurden.","canonical_url":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-kod-s-pravami-rabochego-proczessa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"de_DE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 PostgreSQL, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17 \u0438 12.21, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b 35 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 3 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 - \u043e\u0434\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0438 \u0434\u0432\u0435 \u043d\u0435\u043e\u043f\u0430\u0441\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-kod-s-pravami-rabochego-proczessa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-11-15T23:09:06+00:00","article:modified_time":"2024-11-15T23:09:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120577","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:02:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:02:22","updated":"2026-01-23 08:02:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/120577","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/comments?post=120577"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/120577\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/media?parent=120577"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/categories?post=120577"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/tags?post=120577"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}