medium
4.2
CWE
266
Advisory Published
Updated

CVE-2024-10978: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID

First published: Thu Nov 14 2024(Updated: )

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

Credit: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Affected SoftwareAffected VersionHow to fix
debian/postgresql-13<=13.16-0+deb11u1
13.20-0+deb11u1
debian/postgresql-15
15.12-0+deb12u2
15.10-0+deb12u1
debian/postgresql-17
17.4-1
PostgreSQL>=12.0<12.21
PostgreSQL>=13.0<13.17
PostgreSQL>=14.0<14.14
PostgreSQL>=15.0<15.9
PostgreSQL>=16.0<16.5
PostgreSQL=17.0
PostgreSQL=17.0-beta1
PostgreSQL=17.0-beta2
PostgreSQL=17.0-beta3
PostgreSQL=17.0-rc1
Debian Linux=11.0

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2024-10978?

    CVE-2024-10978 has a severity rating that indicates a medium risk due to the potential for incorrect privilege assignment leading to unauthorized data access.

  • How do I fix CVE-2024-10978?

    To fix CVE-2024-10978, upgrade to the patched versions of PostgreSQL, which are postgres-13 version 13.18-0+deb11u1 or higher, postgres-15 version 15.10-0+deb12u1 or higher, and make sure other versions are not used.

  • What are the affected versions in CVE-2024-10978?

    CVE-2024-10978 affects PostgreSQL versions up to and including 13.16-0+deb11u1, 15.8-0+deb12u1, and 16.4-3.

  • Can CVE-2024-10978 be exploited remotely?

    Exploitation of CVE-2024-10978 requires that the attacker have application-level access that enables the use of features like SET ROLE or SET SESSION AUTHORIZATION.

  • What type of vulnerability is CVE-2024-10978?

    CVE-2024-10978 is classified as a privilege escalation vulnerability in PostgreSQL.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203