CVE-2024-10978

A flaw was found in PostgreSQL. This vulnerability allows a less-privileged application user to view or change unintended rows using SET ROLE, SET SESSION AUTHORIZATION, or equivalent features resulting in loss of confidentiality integrity and availability.

Impact: Moderate. In Red Hat Enterprise Linux, PostgreSQL is affected by a flaw in which a less-privileged application user can view or modify unintended rows when an application uses SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature and attacker-influenced parameters or query results cause a query to depend on current_setting('role') or the current user ID. The CVSS 3.1 score is 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), reflecting network reachability, low privileges, and high attack complexity, with limited confidentiality and integrity impact and no availability impact. The current affects mark PostgreSQL as affected in the Red Hat Enterprise Linux update streams represented for RHEL 8, RHEL 9, and RHEL for Business 10; community-project packages are delegated to upstream. For Red Hat In-Vehicle OS, remediation is deferred with the tracker resolved as "Won't Do"; the record gives no more specific deferral rationale, and residual risk remains that a qualifying less-privileged application user could access or change unintended rows. For the delegated affected products, a fix is being pursued.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.