What’s Vulnerable › Vulnerabilities

CVE-2024-10979: PostgreSQL PL/Perl environment variable changes execute arbitrary code

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-11-14 · updated 2026-06-17
• Weakness: CWE-15

Description

Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

Affected products

• PostgreSQL: from 12.0 before 12.21; from 13.0 before 13.17; from 14.0 before 14.14; from 15.0 before 15.9; from 16.0 before 16.5; from 17.0 before 17.1 — fixed in 12.21, 13.17, 14.14, 15.9, 16.5, 17.1

How to fix

Upgrade to a fixed version: PostgreSQL 12.21, 13.17, 14.14, 15.9. Check the vendor advisory for mitigations.

References

• https://www.postgresql.org/support/security/CVE-2024-10979/
• https://github.com/fmora50591/postgresql-env-vuln/blob/main/README.md
• https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html
• https://security.netapp.com/advisory/ntap-20250110-0003/

Get alerted when CVE-2024-10979 or the next vulnerability affects your stack