CVE-2024-7348: PostgreSQL relation replacement during pg_dump executes arbitrary SQL
Last updated 14 November 2024
Other sources
PostgreSQL relation replacement during pgdump executes arbitrary SQL
— Microsoft
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Time-of-check Time-of-use (TOCTOU) race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pgdump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pgdump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7348?
The severity of CVE-2024-7348 has not been explicitly detailed and likely varies based on the specific context of the affected systems.
How do I fix CVE-2024-7348?
To mitigate CVE-2024-7348, update PostgreSQL to a version that is not affected, namely versions later than the specified vulnerable versions.
What software is affected by CVE-2024-7348?
CVE-2024-7348 affects specific versions of PostgreSQL, particularly versions 12.0 up to 12.20, 13.0 up to 13.16, and others listed in the advisory.
Are there known exploits for CVE-2024-7348?
As of now, there are no publicly known exploits targeting CVE-2024-7348, but monitoring and patching is advised.
Is there a workaround for CVE-2024-7348?
Currently, the recommended approach is to upgrade PostgreSQL to a secure version rather than relying on workarounds.