CVE-2024-7348

A vulnerability was found in PostgreSQL. A Race condition in pg_dump allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser.

Satellite PostgreSQL is pulled through a base layered OS product and/or appstream repository and it is not shipped through this offering.

This TOCTOU race condition in pg_dump is a important severity issue because it enables a non-privileged database user to escalate their privileges and execute arbitrary SQL functions as the superuser, compromising the entire database system. The exploitation of this vulnerability is particularly dangerous due to the inherent privilege level associated with the pg_dump process, which typically operates with elevated rights to ensure comprehensive backups. The ease of exploitation—due to the trivial nature of winning the race condition by holding an open transaction—further amplifies the risk, making it a significant threat in environments running affected PostgreSQL versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.