CVE-2024-10976: PostgreSQL row security below e.g. subqueries disregards user ID changes
First published: Thu Nov 14 2024(Updated: )
Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. <a href="https://access.redhat.com/security/cve/CVE-2023-2455">CVE-2023-2455</a> and <a href="https://access.redhat.com/security/cve/CVE-2016-2193">CVE-2016-2193</a> fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. An attacker must tailor an attack to a particular application's pattern of query plan reuse, user ID changes, and role-specific row security policies. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
Credit: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/postgresql-13 | <=13.16-0+deb11u1 | 13.18-0+deb11u1 |
| debian/postgresql-15 | <=15.8-0+deb12u1 | 15.10-0+deb12u1 |
| debian/postgresql-16 | <=16.4-3 | |
| debian/postgresql-17 | 17.2-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.postgresql.org/support/security/CVE-2024-10976/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10976
- https://nvd.nist.gov/vuln/detail/CVE-2024-10976
- https://launchpad.net/bugs/cve/CVE-2024-10976
- https://security-tracker.debian.org/tracker/CVE-2024-10976
- https://ubuntu.com/security/CVE-2024-10976
- https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=edcda9bb4c4500b75bb4a16c7c59834398ca2906
- https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=562289460e118fcad44ec916dcdab21e4763c38c
- https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=6db5ea8de8ce15897b706009aaf701d23bd65b23
- https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=4e51030af9e0a12d7fa06b73acd0c85024f81062
- https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=952ff31e2a89e8ca79ecb12d61fddbeac3d89176
- https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=448525e8a44080b6048e24f6942284b7eeae1a5c
- https://access.redhat.com/security/cve/CVE-2023-2455
- https://access.redhat.com/security/cve/CVE-2016-2193
- https://access.redhat.com/errata/RHSA-2024:10785
- https://access.redhat.com/errata/RHSA-2024:10788
- https://access.redhat.com/errata/RHSA-2024:10787
- https://access.redhat.com/errata/RHSA-2024:10791
- https://access.redhat.com/errata/RHSA-2024:10830
- https://access.redhat.com/errata/RHSA-2024:10832
- https://access.redhat.com/errata/RHSA-2024:10831
- https://bugzilla.redhat.com/show_bug.cgi?id=2326263
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/author
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- collector/launchpad-cve
- source/Launchpad
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/severity
- agent/event
- agent/description
- agent/references
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-10976
- agent/last-modified-date
- agent/trending
- package-manager/debian