Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufsUpgrade postgresqlUpgrade postgresql-upgrade-develUpgrade postgresql-private-develUpgrade postgresql-docsUpgrade pg_repackUpgrade postgresql-staticUpgrade pgauditUpgrade postgresql-testUpgrade pgvectorUpgrade postgresql-serverUpgrade postgresql-upgradeUpgrade postgresql-private-libsUpgrade postgresql-contribUpgrade postgresql-plpython3Upgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-server-develUpgrade postgresql-test-rpm-macros | Dec 6, 2024 | Nov 14, 2024 |
| Alpine Linux | — | Upgrade postgresql16Upgrade postgresql17Upgrade postgresql15Upgrade postgresql13Upgrade postgresql14 | Aug 8, 2025 | Nov 14, 2024 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-plpython3Upgrade postgresqlUpgrade postgresql-private-libsUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql-testUpgrade libpqUpgrade libpq-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-server-develUpgrade postgresql-plpythonUpgrade postgresql-private-develUpgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade postgresql-debuginfoUpgrade postgresql-develUpgrade postgresql-upgrade-develUpgrade postgresql-llvmjitUpgrade libpq-devel | Dec 20, 2024 | Nov 14, 2024 |
| Amazon_linux_2023 | — | Upgrade postgresql15-upgradeUpgrade postgresql16-test-debuginfoUpgrade postgresql16-upgrade-develUpgrade postgresql15-server-develUpgrade postgresql16-plperl-debuginfoUpgrade postgresql16-docsUpgrade postgresql15-testUpgrade postgresql15Upgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-private-develUpgrade postgresql15-contrib-debuginfoUpgrade postgresql16-test-rpm-macrosUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql15-plperl-debuginfoUpgrade postgresql16-staticUpgrade postgresql15-staticUpgrade postgresql16-server-devel-debuginfoUpgrade postgresql16-pltcl-debuginfoUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql16-server-develUpgrade postgresql16-testUpgrade postgresql16-docs-debuginfoUpgrade postgresql15-plperlUpgrade postgresql15-test-debuginfoUpgrade postgresql16-llvmjitUpgrade postgresql16-plpython3-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql16-debuginfoUpgrade postgresql16-server-debuginfoUpgrade postgresql15-private-libsUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql16-pltclUpgrade postgresql16-upgrade-devel-debuginfoUpgrade postgresql16-debugsourceUpgrade postgresql16-contrib-debuginfoUpgrade postgresql15-docs-debuginfoUpgrade postgresql16Upgrade postgresql15-upgrade-develUpgrade postgresql15-llvmjitUpgrade postgresql16-upgradeUpgrade postgresql16-upgrade-debuginfoUpgrade postgresql16-plperlUpgrade postgresql16-contribUpgrade postgresql15-docsUpgrade postgresql15-test-rpm-macrosUpgrade postgresql16-llvmjit-debuginfoUpgrade postgresql15-debugsourceUpgrade postgresql16-plpython3Upgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-plpython3Upgrade postgresql16-private-develUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql16-private-libs-debuginfoUpgrade postgresql15-pltclUpgrade postgresql16-serverUpgrade postgresql15-serverUpgrade postgresql15-debuginfoUpgrade postgresql16-private-libsUpgrade postgresql15-contrib | Feb 17, 2025 | Nov 14, 2024 |
| Debian | — | Upgrade postgresql-17Upgrade postgresql-15Upgrade postgresql-13 | Nov 18, 2024 | Nov 14, 2024 |
| Dell Powerstore Dsa2025342 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Freebsd | — | Upgrade postgresql15-plperlUpgrade postgresql12-plperlUpgrade postgresql17-plperlUpgrade postgresql14-plperlUpgrade postgresql13-plperlUpgrade postgresql16-plperl | Nov 15, 2024 | Nov 14, 2024 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Dec 9, 2024 | Nov 14, 2024 |
| Oracle_linux | — | Upgrade pgvectorUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgres-decoderbufsUpgrade postgresql-private-develUpgrade pgauditUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-private-libsUpgrade pg_repackUpgrade postgresql-static | Dec 5, 2024 | Nov 14, 2024 |
| Postgres | — | Upgrade to PostgreSQL version 16.5Upgrade to PostgreSQL version 15.9Upgrade to PostgreSQL version 17.1Upgrade to PostgreSQL version 14.14Upgrade to the latest version of PostgreSQL | Nov 15, 2024 | Nov 14, 2024 |
| Redhat_linux | — | Upgrade pgvector-debuginfoUpgrade pg_repack-debugsourceUpgrade postgres-decoderbufsUpgrade pg_repack-debuginfoUpgrade pgvector-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-debuginfoUpgrade pgauditUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade pgvectorUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-pltclUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-private-develUpgrade postgresql-docsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgres-decoderbufs-debugsourceNo solution existsUpgrade postgresql-test-debuginfoUpgrade postgresql-plperlUpgrade postgresql-docs-debuginfoUpgrade postgresqlUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-server-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-plpython3Upgrade postgresql-libsUpgrade pg_repackUpgrade postgresql-static | Feb 10, 2025 | Nov 14, 2024 |
| Rocky_linux | — | Upgrade postgresql-docs-debuginfoUpgrade postgresql-plperlUpgrade postgresql-test-debuginfoUpgrade postgresql-serverUpgrade postgresql-staticUpgrade postgresql-plpython3Upgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgradeUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-docsUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-contribUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-testUpgrade pgaudit-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-pltclUpgrade pgauditUpgrade pg_repackUpgrade postgresql-private-develUpgrade postgresql-server-develUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-debugsourceUpgrade postgresql-private-libsUpgrade postgres-decoderbufsUpgrade postgresql-debuginfoUpgrade postgresql | Feb 5, 2026 | Dec 19, 2024 |
| Suse | — | Upgrade postgresql16-pltclUpgrade postgresql16-testUpgrade postgresql17-llvmjit-develUpgrade postgresql-contribUpgrade postgresql13-server-develUpgrade postgresql12-llvmjit-develUpgrade postgresql15-serverUpgrade postgresql12-plperlUpgrade postgresql16-llvmjitUpgrade postgresql16-llvmjit-develUpgrade postgresql17-pltclUpgrade postgresql-develUpgrade postgresql13-plpythonUpgrade postgresql14-develUpgrade postgresql16Upgrade libpq5-32bitUpgrade postgresql16-server-develUpgrade postgresql-server-develUpgrade postgresql13-docsUpgrade postgresql14-contribUpgrade postgresql14-plperlUpgrade postgresql12-serverUpgrade postgresql13-testUpgrade libecpg6Upgrade postgresql15-docsUpgrade postgresql16-plpythonUpgrade postgresql17-serverUpgrade postgresql16-contribUpgrade postgresql17-develUpgrade postgresql16-serverUpgrade postgresql15-server-develUpgrade postgresql14-llvmjitUpgrade postgresql-pltclUpgrade postgresql-llvmjit-develUpgrade postgresql13-develUpgrade postgresql12-docsUpgrade postgresql14Upgrade postgresql17-server-develUpgrade postgresql-llvmjitUpgrade postgresql15-llvmjitUpgrade postgresql-plpythonUpgrade postgresql12-pltclUpgrade postgresql15-plperlUpgrade postgresql12-develUpgrade postgresql14-docsUpgrade postgresql13Upgrade postgresql12-testUpgrade postgresql14-testUpgrade postgresql15-pltclUpgrade postgresql15-llvmjit-develUpgrade postgresql15-contribUpgrade postgresql13-contribUpgrade postgresql-docsUpgrade postgresql14-server-develUpgrade postgresql15Upgrade postgresql15-testUpgrade postgresql13-pltclUpgrade libpq5Upgrade postgresql14-serverUpgrade postgresql17-plpythonUpgrade postgresql17-plperlUpgrade postgresql13-llvmjitUpgrade postgresql-plperlUpgrade postgresql17Upgrade postgresql16-docsUpgrade postgresql13-serverUpgrade postgresql14-plpythonUpgrade postgresql-serverUpgrade postgresql17-llvmjitUpgrade postgresql17-docsUpgrade postgresql15-develUpgrade postgresql13-plperlUpgrade postgresql12-contribUpgrade postgresql16-plperlUpgrade postgresql13-llvmjit-develUpgrade postgresql12-llvmjitUpgrade libecpg6-32bitUpgrade postgresql14-pltclUpgrade postgresql-testUpgrade postgresql16-develUpgrade postgresqlUpgrade postgresql17-contribUpgrade postgresql14-llvmjit-develUpgrade postgresql12Upgrade postgresql17-testUpgrade postgresql12-server-develUpgrade postgresql15-plpythonUpgrade postgresql12-plpython | Dec 31, 2024 | Nov 14, 2024 |
| Ubuntu | — | Upgrade postgresql-client-16Upgrade postgresql-client-14Upgrade postgresql-client-9.5 (Ubuntu Pro)Upgrade postgresql-9.5 (Ubuntu Pro)Upgrade postgresql-client-12Upgrade postgresql-16Upgrade postgresql-12Upgrade postgresql-14 | Dec 3, 2024 | Nov 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 14, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub