CVE-2024-10979 — PostgreSQL PL/Perl environment variable changes execute arbitrary code

Description (CNA)

Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

Affected (CNA)

Vendor / product	Versions
n/a / PostgreSQL	affected 17 before 17.1; affected 16 before 16.5; affected 15 before 15.9; affected 14 before 14.14; affected 13 before 13.17; affected 0 before 12.21

CWE

CWE-15

References

https://www.postgresql.org/support/security/CVE-2024-10979/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://github.com/fmora50591/postgresql-env-vuln/blob/main/README.md
https://security.netapp.com/advisory/ntap-20250110-0003/
https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html