Corrective updates have been released for all supported branches of PostgreSQL 16.4, 15.8, 14.13, 13.16, 12.20, addressing 56 bugs identified over the last three months. Among other issues, the new versions have patched a vulnerability (CVE-2024-7348) categorized as critical (risk level 8.8 out of 10). This vulnerability arises from a race condition in the pg_dump utility, allowing an attacker, who has the ability to create and delete persistent objects in the database, to execute arbitrary SQL code with the privileges of the user running the pg_dump utility (usually, pg_dump is run with superuser privileges for database backups).
To successfully exploit the vulnerability, an attacker must track the moment the pg_dump utility is initiated, which can be easily achieved through manipulations with an open transaction. The attack involves substituting a sequence with a view or external table that determines the SQL code being executed at the time of pg_dump's initiation when the sequence information has already been obtained but the data has not yet been outputted. To block this vulnerability, a new setting named 'restrict_nonsystem_relation_kind' has been added, prohibiting the exposure of non-system views and access to external tables in pg_dump.
Source: opennet.ru
