CVE-2024-10978: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID
Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to currentsetting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10978?
CVE-2024-10978 has a severity rating that indicates a medium risk due to the potential for incorrect privilege assignment leading to unauthorized data access.
How do I fix CVE-2024-10978?
To fix CVE-2024-10978, upgrade to the patched versions of PostgreSQL, which are postgres-13 version 13.18-0+deb11u1 or higher, postgres-15 version 15.10-0+deb12u1 or higher, and make sure other versions are not used.
What are the affected versions in CVE-2024-10978?
CVE-2024-10978 affects PostgreSQL versions up to and including 13.16-0+deb11u1, 15.8-0+deb12u1, and 16.4-3.
Can CVE-2024-10978 be exploited remotely?
Exploitation of CVE-2024-10978 requires that the attacker have application-level access that enables the use of features like SET ROLE or SET SESSION AUTHORIZATION.
What type of vulnerability is CVE-2024-10978?
CVE-2024-10978 is classified as a privilege escalation vulnerability in PostgreSQL.