CVE-2024-7348 — PostgreSQL relation replacement during pg_dump executes arbitrary SQL

Description (CNA)

Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.

Affected (CNA)

Vendor / product	Versions
n/a / PostgreSQL	affected 16 before 16.4; affected 15 before 15.8; affected 14 before 14.13; affected 13 before 13.16; affected 0 before 12.20

CWE

CWE-367

References

https://www.postgresql.org/support/security/CVE-2024-7348/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2024/08/11/1
https://security.netapp.com/advisory/ntap-20240822-0002/