Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 9 PostgreSQL TOCTOU Update MGASA-2024-0301 Critical Advisory

mageia
Calendar Grey September 16, 2024
Dist Mageia Esm H88
Ubuntu 2024-0402 patches resolve a race condition vulnerability in MySQL, significantly improving database safety.
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a...

Summary

Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. (CVE-2024-7348)

References

- https://bugs.mageia.org/show_bug.cgi?id=33503

- https://www.postgresql.org/about/news/postgresql-164-158-1413-1316-1220-and-17-beta-3-released-2910/

- https://www.postgresql.org/support/security/CVE-2024-7348/

- https://www.cve.org/CVERecord?id=CVE-2024-7348

Topics%20covered

Topics Covered

security advisory security update critical PostgreSQL Mageia TOCTOU

Resolution

SRPMS

- 9/core/postgresql15-15.8-1.mga9

- 9/core/postgresql13-13.16-1.mga9

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 16 Sep 2024
URL: https://advisories.mageia.org/MGASA-2024-0301.html
Type: security
CVE: CVE-2024-7348

Topics%20covered

Topics Covered

security advisory security update critical PostgreSQL Mageia TOCTOU

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here