CVE-2024-7348
High
Description
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Postgresql
PublishedAug 8, 2024
First seenAug 8, 2024
Weakness typeCWE-367CWE-367
How to fix
Update
- postgresql postgresql12.20, 13.16, 14.13, 15.8, 16.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| postgresql postgresql | 12.0 ≤ v < 12.20, 13.0 ≤ v < 13.16, 14.0 ≤ v < 14.13, 15.0 ≤ v < 15.8, 16.0 ≤ v < 16.4 | 12.20, 13.16, 14.13, 15.8, 16.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.