Unprivileged User Can Execute Arbitrary Code via Environment Variables

CVE-2024-10979

Summary

The PostgreSQL open-source database system has a high-severity security flaw (CVE-2024-10979) that allows unprivileged users to alter environment variables, potentially leading to code execution or information disclosure. This vulnerability could enable an attacker to execute arbitrary code by modifying environment variables such as PATH, or extract valuable information by running malicious queries. Exploitation has not been reported, and the issue has been addressed in PostgreSQL versions 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21. Users are advised to update their systems to prevent potential code execution and data breaches.

News Articles

Hackread

CVE-2024-10979

8.8 Rated PostgreSQL Vulnerability Puts Databases at Risk

Cybersecurity researchers have identified a serious security flaw in PostgreSQL that could lead to data breaches and system compromise.

The Hacker News

CVE-2024-10979

High-Severity Flaw in PostgreSQL Allows Hackers to Exploit Environment Variables

Critical PostgreSQL flaw (CVE-2024-10979) patched; update now to prevent code execution and data breaches.

References