CVE-2024-10979

A flaw was found in PostgreSQL PL/Perl. This vulnerability allows an unprivileged database user to change sensitive process environment variables (e.g., PATH) via incorrect control of environment variables.

This vulnerability has been given a severity rating of important because the ability to modify sensitive process environment variables (ex. PATH) can lead to unauthorized code execution and privilege escalation. Depending on the privileges of the PostgreSQL user, an attacker may be able to gain higher-level access to the underlying server and create functions who modify environment variables and execute arbitrary commands.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Currently the following options exist to help mitigate the impact of this vulnerability:

1. Restrict Permissions: the creation of PL/Python and PL/Perl functions should be limited to trusted users only.
2. Environment Variable Sanitization: ensure that environment variables are properly sanitized and any modifications are restricted.
3. Upgrade PostgreSQL: if a fix is released by the PostgreSQL Global Development Group, update to the latest version.
4. Audit Database Functions: perform regular audits on user-created functions to detect and prevent potential exploitation.