{"id":120577,"date":"2024-11-16T01:09:06","date_gmt":"2024-11-15T23:09:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-kod-s-pravami-rabochego-proczessa"},"modified":"2024-11-16T01:09:06","modified_gmt":"2024-11-15T23:09:06","slug":"uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-kod-s-pravami-rabochego-proczessa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-kod-s-pravami-rabochego-proczessa","title":{"rendered":"Kwetsbaarheid in PostgreSQL die het mogelijk maakt om code uit te voeren met de rechten van een werkproces","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Corrigerende updates zijn aangemaakt voor alle ondersteunde versies van PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17 en 12.21, waarin 35 fouten zijn verholpen en 3 kwetsbaarheden zijn ge\u00eblimineerd \u2014 \u00e9\u00e9n ernstige en twee minder ernstige. Ook is aangekondigd dat de ondersteuning voor de PostgreSQL 12 versie zal worden be\u00ebindigd, waarvoor geen verdere updates zullen worden uitgebracht. <\/p>\n

De ernstige kwetsbaarheid (CVE-2024-10979), die een gevaarlijkheidsniveau van 8,8 uit 10 heeft, stelt een lokale gebruiker van de database, die rechten heeft om PL\/Perl-functies aan te maken, in staat om code uit te voeren met de rechten van de gebruiker onder wie de database draait. De kwetsbaarheid wordt veroorzaakt doordat in PL\/Perl-functies omgevingsvariabelen van het proces kunnen worden gewijzigd, inclusief de PATH-variabele die paden naar uitvoerbare bestanden bepaalt, en PostgreSQL-specifieke omgevingsvariabelen. Het wordt opgemerkt dat voor een aanval alleen toegang tot de database vereist is en dat er geen systeemaccount nodig is. CREATE OR REPLACE FUNCTION plperl_set_env_var() RETURNS void AS $$ $ENV{\u2018ENV_VAR\u2019} = \u2018testval\u2019; $$ LANGUAGE plperl; SELECT plperl_set_env_var();
\n
Bron: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17 \u0438 12.21, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b 35 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 3 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 — \u043e\u0434\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0438 \u0434\u0432\u0435 \u043d\u0435\u043e\u043f\u0430\u0441\u043d\u044b\u0445. \u0422\u0430\u043a\u0436\u0435 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u043e \u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0432\u0435\u0442\u043a\u0438 PostgreSQL 12, \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u043e\u043b\u044c\u0448\u0435 \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0435 \u0431\u0443\u0434\u0443\u0442. \u041e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-10979), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 8.8 \u0438\u0437 10, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120577","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kwetsbaarheid in PostgreSQL die het mogelijk maakt om code uit te voeren met de rechten van het werkproces | ProHoster","description":"Correctieve updates zijn opgesteld voor alle ondersteunde versies van PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17 en 12.21, waarin 35 fouten zijn verholpen en 3 kwetsbaarheden zijn ge\u00eblimineerd - \u00e9\u00e9n kwetsbaarheid is ernstig en twee zijn niet ernstig.","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-kod-s-pravami-rabochego-proczessa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 PostgreSQL, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17 \u0438 12.21, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b 35 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 3 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 - \u043e\u0434\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0438 \u0434\u0432\u0435 \u043d\u0435\u043e\u043f\u0430\u0441\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-kod-s-pravami-rabochego-proczessa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-11-15T23:09:06+00:00","article:modified_time":"2024-11-15T23:09:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120577","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:02:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:02:22","updated":"2026-01-23 08:02:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/120577","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=120577"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/120577\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=120577"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=120577"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=120577"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}