{"id":120577,"date":"2024-11-16T01:09:06","date_gmt":"2024-11-15T23:09:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-kod-s-pravami-rabochego-proczessa"},"modified":"2024-11-16T01:09:06","modified_gmt":"2024-11-15T23:09:06","slug":"uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-kod-s-pravami-rabochego-proczessa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-kod-s-pravami-rabochego-proczessa","title":{"rendered":"S\u00e5rbarhet i PostgreSQL som m\u00f6jligg\u00f6r kodexekvering med arbetsprocessens r\u00e4ttigheter","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Korrigerande uppdateringar har skapats f\u00f6r alla st\u00f6dda versioner av PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17 och 12.21, d\u00e4r 35 buggar har \u00e5tg\u00e4rdats och 3 s\u00e5rbarheter har eliminerats \u2014 en farlig och tv\u00e5 ofarliga. Det har ocks\u00e5 meddelats att st\u00f6det f\u00f6r versionen PostgreSQL 12 kommer att upph\u00f6ra och inga fler uppdateringar kommer att skapas f\u00f6r den. <\/p>\n

Den farliga s\u00e5rbarheten (CVE-2024-10979), som har tilldelats riskniv\u00e5n 8.8 av 10, g\u00f6r det m\u00f6jligt f\u00f6r en lokal databas-anv\u00e4ndare med r\u00e4ttigheter att skapa PL\/Perl-funktioner att k\u00f6ra kod med de r\u00e4ttigheter som anv\u00e4ndes av databasen. S\u00e5rbarheten orsakas av att variablerna f\u00f6r arbetsmilj\u00f6n kan \u00e4ndras i PL\/Perl-funktioner, inklusive PATH-variabeln, som definierar s\u00f6kv\u00e4gar till exekverbara filer, samt specifika PostgreSQL-milj\u00f6variabler. Det p\u00e5pekas att det r\u00e4cker med \u00e5tkomst till databasen f\u00f6r att genomf\u00f6ra attacken och att det inte kr\u00e4vs n\u00e5got systemkonto. CREATE OR REPLACE FUNCTION plperl_set_env_var() RETURNS void AS $$ $ENV{‘ENV_VAR’} = ‘testval’; $$ LANGUAGE plperl; SELECT plperl_set_env_var();
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17 \u0438 12.21, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b 35 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 3 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 — \u043e\u0434\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0438 \u0434\u0432\u0435 \u043d\u0435\u043e\u043f\u0430\u0441\u043d\u044b\u0445. \u0422\u0430\u043a\u0436\u0435 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u043e \u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0432\u0435\u0442\u043a\u0438 PostgreSQL 12, \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u043e\u043b\u044c\u0448\u0435 \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0435 \u0431\u0443\u0434\u0443\u0442. \u041e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-10979), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 8.8 \u0438\u0437 10, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120577","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhet i PostgreSQL som m\u00f6jligg\u00f6r k\u00f6rning av kod med arbetsprocessens r\u00e4ttigheter | ProHoster","description":"Korrigerande uppdateringar har sl\u00e4ppts f\u00f6r alla st\u00f6dda versioner av PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17 och 12.21, d\u00e4r 35 fel har \u00e5tg\u00e4rdats och 3 s\u00e5rbarheter har eliminerats - en farlig och tv\u00e5 som inte \u00e4r farliga.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-kod-s-pravami-rabochego-proczessa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 PostgreSQL, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17 \u0438 12.21, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b 35 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 3 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 - \u043e\u0434\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0438 \u0434\u0432\u0435 \u043d\u0435\u043e\u043f\u0430\u0441\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-kod-s-pravami-rabochego-proczessa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-11-15T23:09:06+00:00","article:modified_time":"2024-11-15T23:09:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120577","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:02:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:02:22","updated":"2026-01-23 08:02:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/120577","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=120577"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/120577\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=120577"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=120577"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=120577"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}