Corrective updates have been released for all supported branches of PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21, addressing 35 bugs and fixing 3 vulnerabilitiesāone critical and two non-critical. Support for PostgreSQL 12 has also been officially discontinued, and no further updates will be issued for this version.
A critical vulnerability (CVE-2024-10979), rated 8.8 out of 10 in severity, allows a local Database Management System user with rights to create PL/Perl functions to execute code with the same user privileges under which the DBMS runs. The vulnerability arises because PL/Perl functions can modify environment variables of the worker process, including the PATH variable that defines executable file paths, as well as PostgreSQL-specific environment variables. It is noted that the attacker only needs access to the DBMS and does not require a system account. CREATE OR REPLACE FUNCTION plperl_set_env_var() RETURNS void AS $$ $ENV{āENV_VARā} = ātestvalā; $$ LANGUAGE plperl; SELECT plperl_set_env_var();
Source: opennet.ru
