git: 0c9ebc9a5f6f - main - security/vuxml: Document vulnerability in postgresql
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 08 Aug 2024 13:02:52 UTC
The branch main has been updated by girgen:
URL: https://cgit.FreeBSD.org/ports/commit/?id=0c9ebc9a5f6feb6859c23e2ea875f9d4f59b3e38
commit 0c9ebc9a5f6feb6859c23e2ea875f9d4f59b3e38
Author: Palle Girgensohn <girgen@FreeBSD.org>
AuthorDate: 2024-08-08 09:50:59 +0000
Commit: Palle Girgensohn <girgen@FreeBSD.org>
CommitDate: 2024-08-08 13:02:47 +0000
security/vuxml: Document vulnerability in postgresql
---
security/vuxml/vuln/2024.xml | 50 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 50 insertions(+)
diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml
index 533da1f15beb..295762a52a95 100644
--- a/security/vuxml/vuln/2024.xml
+++ b/security/vuxml/vuln/2024.xml
@@ -1,3 +1,53 @@
+ <vuln vid="48e6d514-5568-11ef-af48-6cc21735f730">
+ <topic>PostgreSQL -- Prevent unauthorized code execution during pg_dump</topic>
+ <affects>
+ <package>
+ <name>postgresql-client</name>
+ <range><lt>16.4</lt></range>
+ <range><lt>15.8</lt></range>
+ <range><lt>14.13</lt></range>
+ <range><lt>13.16</lt></range>
+ <range><lt>12.20</lt></range>
+ </package>
+ <package>
+ <name>postgresql-server</name>
+ <range><lt>16.4</lt></range>
+ <range><lt>15.8</lt></range>
+ <range><lt>14.13</lt></range>
+ <range><lt>13.16</lt></range>
+ <range><lt>12.20</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>PostgreSQL project reports:</p>
+ <blockquote cite="https://www.postgresql.org/support/security/CVE-2024-7348/">
+ <p>
+ An attacker able to create and drop non-temporary objects could
+ inject SQL code that would be executed by a concurrent pg_dump
+ session with the privileges of the role running pg_dump
+ (which is often a superuser). The attack involves replacing a
+ sequence or similar object with a view or foreign table that will
+ execute malicious code. To prevent this, introduce a new server
+ parameter restrict_nonsystem_relation_kind that can disable
+ expansion of non-builtin views as well as access to foreign
+ tables, and teach pg_dump to set it when available. Note that the
+ attack is prevented only if both pg_dump and the server it is
+ dumping from are new enough to have this fix.
+ </p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2024-7348</cvename>
+ <url>https://www.postgresql.org/support/security/CVE-2024-7348/</url>
+ </references>
+ <dates>
+ <discovery>2024-08-08</discovery>
+ <entry>2024-08-08</entry>
+ </dates>
+ </vuln>
+
<vuln vid="db8fa362-0ccb-4aa8-9220-72b7763e9a4a">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>