REDHAT-BUG-2388553: High severity PostgreSQL postgresql vulnerability
Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pgdumpall is also affected. pgrestore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.6 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.10 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.14 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.19 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 13.22
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2388553?
The severity of REDHAT-BUG-2388553 is critical due to the potential for arbitrary code execution.
How do I fix REDHAT-BUG-2388553?
To fix REDHAT-BUG-2388553, upgrade PostgreSQL to versions later than 13.22, 14.19, 15.14, 16.10, and 17.6.
What versions of PostgreSQL are affected by REDHAT-BUG-2388553?
PostgreSQL versions up to 13.21, 14.18, 15.13, 16.9, and 17.5 are affected by REDHAT-BUG-2388553.
What components are impacted by REDHAT-BUG-2388553?
REDHAT-BUG-2388553 impacts pg_dump, pg_dumpall, and pg_restore components of PostgreSQL.
Who can exploit REDHAT-BUG-2388553?
A malicious superuser of the origin server can exploit REDHAT-BUG-2388553 to inject arbitrary code.