Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 471
Alerts This Week
Warning Icon 1 471

Gentoo: GLSA 202409-02 High: PostgreSQL Privilege Escalation Advisory

gentoo
Calendar Grey September 22, 2024
Scroller Gentoo
Critical alert issued for MySQL on Fedora OS highlights potential access escalation vulnerabilities with essential patching instructions.
A vulnerability has been discovered in PostgreSQL, which can lead to privilege escalation.

Summary

A vulnerability has been discovered in PostgreSQL. Please review the CVE identifier referenced below for details.

Topics%20covered

Topics Covered

security advisory high severity privilege escalation PostgreSQL Gentoo Linux

Resolution

All PostgreSQL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/postgresql-12.20:12" # emerge --ask --oneshot --verbose ">=dev-db/postgresql-13.16:13" # emerge --ask --oneshot --verbose ">=dev-db/postgresql-14.13:14" # emerge --ask --oneshot --verbose ">=dev-db/postgresql-15.8:15" # emerge --ask --oneshot --verbose ">=dev-db/postgresql-16.4:16"

References

[ 1 ] CVE-2024-7348 https://nvd.nist.gov/vuln/detail/CVE-2024-7348

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202409-02
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: High
Title: PostgreSQL: Privilege Escalation
Date: September 22, 2024
Bugs: #937573
ID: 202409-02

Topics%20covered

Topics Covered

security advisory high severity privilege escalation PostgreSQL Gentoo Linux

Synopsis

A vulnerability has been discovered in PostgreSQL, which can lead to privilege escalation.

Background

PostgreSQL is an open source object-relational database management system.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

Package Vulnerable Unaffected ----------------- ------------ ------------ dev-db/postgresql < 12.20:12 >= 12.20:12 < 13.16:13 >= 13.16:13 < 14.13:14 >= 14.13:14 < 15.8:15 >= 15.8:15 < 16.4:16 >= 16.4:16

Impact

An attacker able to create and drop non-temporary objects could inject SQL code that would be executed by a concurrent pg_dump session with the privileges of the role running pg_dump (which is often a superuser). The attack involves replacing a sequence or similar object with a view or foreign table that will execute malicious code. To prevent this, introduce a new server parameter restrict_nonsystem_relation_kind that can disable expansion of non-builtin views as well as access to foreign tables, and teach pg_dump to set it when available. Note that the attack is prevented only if both pg_dump and the server it is dumping from are new enough to have this fix.

Workaround

There is no known workaround at this time.