PostgreSQL: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 4

• High 8.8
  CVE-2024-10979

  PostgreSQL PL/Perl environment variable changes execute arbitrary code

  Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database …

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  Nov 14, 2024
• Medium 4.2
  CVE-2024-10976

  PostgreSQL row security below e.g. subqueries disregards user ID changes

  Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where …

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  Nov 14, 2024
• Medium 4.2
  CVE-2024-10978

  PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID

  Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem a…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  Nov 14, 2024
• Low 3.1
  CVE-2024-10977

  PostgreSQL libpq retains an error message from man-in-the-middle

  Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human …

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  Nov 14, 2024

Revision history

1. 2026-10-21 #38

   Neue Updates von Oracle Linux aufgenommen

2. 2026-06-25 #37

   Neue Updates von Oracle Linux aufgenommen

3. 2026-03-10 #36

   Neue Updates von Oracle Linux aufgenommen

4. 2026-03-09 #35

   Neue Updates von Oracle Linux aufgenommen

5. 2025-12-01 #34

   Neue Updates von Oracle Linux aufgenommen

6. 2025-11-06 #33

   Neue Updates von NetApp aufgenommen

7. 2025-11-05 #32

   Neue Updates von IBM aufgenommen

8. 2025-10-01 #31

   Neue Updates von Dell aufgenommen

9. 2025-09-01 #30

   Neue Updates von Oracle Linux aufgenommen

10. 2025-08-21 #29

    Neue Updates von NetApp aufgenommen

11. 2025-07-08 #28

    Neue Updates von BROCADE aufgenommen

12. 2025-07-01 #27

    Neue Updates aufgenommen

13. 2025-06-02 #26

    Neue Updates von SUSE aufgenommen

14. 2025-05-14 #25

    Neue Updates von HITACHI aufgenommen

15. 2025-05-11 #24

    Neue Updates von NetApp aufgenommen

16. 2025-04-06 #23

    Neue Updates aufgenommen

17. 2025-03-19 #22

    Neue Updates von Ubuntu aufgenommen

18. 2025-03-05 #21

    Neue Updates aufgenommen

19. 2025-02-25 #20

    Neue Updates von Amazon aufgenommen

20. 2025-02-23 #19

    Neue Updates von Oracle Linux aufgenommen

21. 2025-02-03 #18

    Neue Updates von IBM aufgenommen

22. 2025-01-28 #17

    Neue Updates von IBM aufgenommen

23. 2024-12-23 #16

    Neue Updates von Oracle Linux aufgenommen

24. 2024-12-19 #15

    Neue Updates von Amazon aufgenommen

25. 2024-12-18 #14

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

References

• Oracle Linux Security Advisory ELSA-2024-10832 vom 2024-12-06
  https://linux.oracle.com/errata/ELSA-2024-10832.html
• Oracle Linux Security Advisory ELSA-2024-10785 vom 2024-12-06
  https://linux.oracle.com/errata/ELSA-2024-10785.html
• Oracle Linux Security Advisory ELSA-2024-10787 vom 2024-12-07
  https://linux.oracle.com/errata/ELSA-2024-10787.html
• Gentoo Linux Security Advisory GLSA-202412-12 vom 2024-12-08
  https://security.gentoo.org/glsa/202412-12
• Oracle Linux Security Advisory ELSA-2024-10830 vom 2024-12-06
  https://linux.oracle.com/errata/ELSA-2024-10830.html
• Red Hat Security Advisory RHSA-2024:10879 vom 2024-12-09
  https://access.redhat.com/errata/RHSA-2024:10879
• Red Hat Security Advisory RHSA-2024:10882 vom 2024-12-09
  https://access.redhat.com/errata/RHSA-2024:10882
• Rocky Linux Security Advisory RLSA-2024:10830 vom 2024-12-19
  https://errata.build.resf.org/RLSA-2024:10830
• Rocky Linux Security Advisory RLSA-2024:10785 vom 2024-12-19
  https://errata.build.resf.org/RLSA-2024:10785
• Rocky Linux Security Advisory RLSA-2024:10831 vom 2024-12-19
  https://errata.build.resf.org/RLSA-2024:10831
• Rocky Linux Security Advisory RLSA-2024:10788 vom 2024-12-19
  https://errata.build.resf.org/RLSA-2024:10788
• Rocky Linux Security Advisory RLSA-2024:10832 vom 2024-12-19
  https://errata.build.resf.org/RLSA-2024:10832
• Rocky Linux Security Advisory RLSA-2024:10787 vom 2024-12-19
  https://errata.build.resf.org/RLSA-2024:10787
• Oracle Linux Security Advisory ELSA-2024-10882 vom 2024-12-24
  https://linux.oracle.com/errata/ELSA-2024-10882.html
• IBM Security Bulletin 7179045 vom 2024-12-16
  https://www.ibm.com/support/pages/node/7179045
• Amazon Linux Security Advisory ALASPOSTGRESQL13-2024-008 vom 2024-12-19
  https://alas.aws.amazon.com/AL2/ALASPOSTGRESQL13-2024-008.html
• Amazon Linux Security Advisory ALASPOSTGRESQL14-2024-015 vom 2024-12-19
  https://alas.aws.amazon.com/AL2/ALASPOSTGRESQL14-2024-015.html
• Amazon Linux Security Advisory ALASPOSTGRESQL14-2024-014 vom 2024-12-19
  https://alas.aws.amazon.com/AL2/ALASPOSTGRESQL14-2024-014.html
• Oracle Linux Security Advisory ELSA-2024-10791 vom 2024-12-11
  https://linux.oracle.com/errata/ELSA-2024-10791.html
• PostgreSQL Release Notes vom 2024-11-14
  https://www.postgresql.org/about/news/postgresql-171-165-159-1414-1317-and-1221-released-2955/
• PostgreSQL Security Advisory vom 2024-11-14
  https://www.postgresql.org/support/security/CVE-2024-10976/
• PostgreSQL Security Advisory vom 2024-11-14
  https://www.postgresql.org/support/security/CVE-2024-10977/
• PostgreSQL Security Advisory vom 2024-11-14
  https://www.postgresql.org/support/security/CVE-2024-10978/
• PostgreSQL Security Advisory vom 2024-11-14
  https://www.postgresql.org/support/security/CVE-2024-10979/
• Debian Security Advisory DSA-5812 vom 2024-11-16
  https://lists.debian.org/debian-security-announce/2024/msg00226.html
• openSUSE Security Update OPENSUSE-SU-2024:14502-1 vom 2024-11-16
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AKWDFN2C7BDHNEIL7UAMUE2QLH322LIK/
• openSUSE Security Update OPENSUSE-SU-2024:14505-1 vom 2024-11-16
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RB4KENPNXIDYL7D4OSLN7SICCC2ASXXP/
• Debian Security Advisory DLA-3954 vom 2024-11-16
  https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html
• SUSE Security Update SUSE-SU-2024:4052-1 vom 2024-11-25
  https://lists.suse.com/pipermail/sle-security-updates/2024-November/019843.html
• SUSE Security Update SUSE-SU-2024:4063-1 vom 2024-11-26
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/NM7DG2QZKFAKH2TVO6LI5MFXR43ZC4RC/
• SUSE Security Update SUSE-SU-2024:4098-1 vom 2024-11-28
  https://lists.suse.com/pipermail/sle-security-updates/2024-November/019869.html
• SUSE Security Update SUSE-SU-2024:4097-1 vom 2024-11-28
  https://lists.suse.com/pipermail/sle-security-updates/2024-November/019870.html
• SUSE Security Update SUSE-SU-2024:4096-1 vom 2024-11-28
  https://lists.suse.com/pipermail/sle-security-updates/2024-November/019871.html
• SUSE Security Update SUSE-SU-2024:4095-1 vom 2024-11-28
  https://lists.suse.com/pipermail/sle-security-updates/2024-November/019872.html
• SUSE Security Update SUSE-SU-2024:4099-1 vom 2024-11-28
  https://lists.suse.com/pipermail/sle-security-updates/2024-November/019868.html
• SUSE Security Update SUSE-SU-2024:4118-1 vom 2024-11-29
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/VBMMHVAJJCAP52ZFWBGECD6A3RO5GMX4/
• Red Hat Security Advisory RHSA-2024:10593 vom 2024-12-02
  https://access.redhat.com/errata/RHSA-2024:10593
• SUSE Security Update SUSE-SU-2024:4114-1 vom 2024-11-29
  https://lists.suse.com/pipermail/sle-security-updates/2024-November/019874.html
• Red Hat Security Advisory RHSA-2024:10595 vom 2024-12-02
  https://access.redhat.com/errata/RHSA-2024:10595
• Red Hat Security Advisory RHSA-2024:10705 vom 2024-12-02
  https://access.redhat.com/errata/RHSA-2024:10705
• Ubuntu Security Notice USN-7132-1 vom 2024-12-02
  https://ubuntu.com/security/notices/USN-7132-1
• Red Hat Security Advisory RHSA-2024:10677 vom 2024-12-02
  https://access.redhat.com/errata/RHSA-2024:10677
• Red Hat Security Advisory RHSA-2024:10739 vom 2024-12-03
  https://access.redhat.com/errata/RHSA-2024:10739
• Red Hat Security Advisory RHSA-2024:10788 vom 2024-12-04
  https://access.redhat.com/errata/RHSA-2024:10788
• Red Hat Security Advisory RHSA-2024:10787 vom 2024-12-04
  https://access.redhat.com/errata/RHSA-2024:10787
• Red Hat Security Advisory RHSA-2024:10785 vom 2024-12-04
  https://access.redhat.com/errata/RHSA-2024:10785
• Red Hat Security Advisory RHSA-2024:10750 vom 2024-12-03
  https://access.redhat.com/errata/RHSA-2024:10750
• Red Hat Security Advisory RHSA-2024:10789 vom 2024-12-04
  https://access.redhat.com/errata/RHSA-2024:10789
• Red Hat Security Advisory RHSA-2024:10800 vom 2024-12-04
  https://access.redhat.com/errata/RHSA-2024:10800
• Red Hat Security Advisory RHSA-2024:10827 vom 2024-12-05
  https://access.redhat.com/errata/RHSA-2024:10827
• Red Hat Security Advisory RHSA-2024:10807 vom 2024-12-04
  https://access.redhat.com/errata/RHSA-2024:10807
• SUSE Security Update SUSE-SU-2024:4175-1 vom 2024-12-04
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LS2XLEBNB7SJ2N2QEBUANUTS7ORDE6SO/
• Red Hat Security Advisory RHSA-2024:10831 vom 2024-12-05
  https://access.redhat.com/errata/RHSA-2024:10831
• SUSE Security Update SUSE-SU-2024:4174-1 vom 2024-12-04
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/L5U7GLD2GHOAYD54LYIGZYYVWQYGYFRX/
• SUSE Security Update SUSE-SU-2024:4176-1 vom 2024-12-04
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/DALTZPSAABBADG7HF56AU5UPFJAHAARO/
• Red Hat Security Advisory RHSA-2024:10832 vom 2024-12-05
  https://access.redhat.com/errata/RHSA-2024:10832
• SUSE Security Update SUSE-SU-2024:4173-1 vom 2024-12-04
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/5WIRX4CKTVOW2ASMEMI4CQRBL6C6VQJS/
• RedHat Security Advisory
  https://access.redhat.com/errata/RHSA-2024:10791
• Red Hat Security Advisory RHSA-2024:10830 vom 2024-12-05
  https://access.redhat.com/errata/RHSA-2024:10830
• Red Hat Security Advisory RHSA-2024:10851 vom 2024-12-05
  https://access.redhat.com/errata/RHSA-2024:10851
• Oracle Linux Security Advisory ELSA-2024-10788 vom 2024-12-05
  https://oss.oracle.com/pipermail/el-errata/2024-December/016821.html
• Red Hat Security Advisory RHSA-2024:10846 vom 2024-12-05
  https://access.redhat.com/errata/RHSA-2024:10846
• IBM Security Bulletin 7181893 vom 2025-01-29
  https://www.ibm.com/support/pages/node/7181893
• IBM Security Bulletin 7182335 vom 2025-02-03
  https://www.ibm.com/support/pages/node/7182335
• Oracle Linux Security Advisory ELSA-2025-1741 vom 2025-02-21
  https://linux.oracle.com/errata/ELSA-2025-1741.html
• Amazon Linux Security Advisory ALAS-2025-2764 vom 2025-02-25
  https://alas.aws.amazon.com/AL2/ALAS-2025-2764.html
• WS_FTP Server Service Pack vom 2024-03-05
  https://community.progress.com/s/article/ka7Pb000000Wf3FIAS
• Ubuntu Security Notice USN-7358-1 vom 2025-03-19
  https://ubuntu.com/security/notices/USN-7358-1
• WS_FTP Server Service Pack vom 2024-04-04
  https://community.progress.com/s/article/ka7Pb000000nxF3IAI
• NetApp Security Advisory NTAP-20250509-0010 vom 2025-05-09
  https://security.netapp.com/advisory/ntap-20250509-0010/
• Hitachi Vulnerability Information HITACHI-SEC-2025-113 vom 2025-05-15
  https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-113/index.html
• SUSE Security Update SUSE-SU-2025:01799-1 vom 2025-06-02
  https://lists.suse.com/pipermail/sle-security-updates/2025-June/021018.html
• SEM 2025.2.1 release notes vom 2025-07-02
  https://documentation.solarwinds.com/en/success_center/sem/content/release_notes/sem_2025-2-1_release_notes.htm
• Brocade Security Advisory BSA-2025-3032 vom 2025-07-08
  https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35916
• NetApp Security Advisory NTAP-20250822-0003 vom 2025-08-22
  https://security.netapp.com/advisory/NTAP-20250822-0003
• Oracle Linux Security Advisory ELSA-2025-14862 vom 2025-09-01
  https://linux.oracle.com/errata/ELSA-2025-14862.html
• Dell Security Update vom 2025-10-02
  https://www.dell.com/support/kbdoc/000376224
• IBM Security Bulletin 7250258 vom 2025-11-06
  https://www.ibm.com/support/pages/node/7250258
• NetApp Security Advisory NTAP-20251107-0002 vom 2025-11-07
  https://security.netapp.com/advisory/NTAP-20251107-0002
• Oracle Linux Security Advisory ELSA-2025-28019 vom 2025-12-01
  https://linux.oracle.com/errata/ELSA-2025-28019.html