Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-private-develUpgrade postgresql-testUpgrade postgresql-docsUpgrade pgauditUpgrade postgres-decoderbufsUpgrade pg_repackUpgrade postgresqlUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-plpython3Upgrade postgresql-private-libsUpgrade postgresql-upgradeUpgrade pgvectorUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-server | Dec 6, 2024 | Nov 14, 2024 |
| Alpine Linux | — | Upgrade postgresql16Upgrade postgresql17Upgrade postgresql14Upgrade postgresql15Upgrade postgresql13 | Aug 8, 2025 | Nov 14, 2024 |
| Amazon Linux Ami 2 | — | Upgrade libpqUpgrade postgresql-testUpgrade postgresql-plpython3Upgrade postgresql-private-libsUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade libpq-debuginfoUpgrade postgresql-server-develUpgrade postgresql-develUpgrade postgresql-plpythonUpgrade postgresql-llvmjitUpgrade postgresql-upgrade-develUpgrade postgresql-debuginfoUpgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade libpq-develUpgrade postgresql-private-develUpgrade postgresql-contrib | Dec 20, 2024 | Nov 14, 2024 |
| Amazon_linux_2023 | — | Upgrade postgresql15-upgrade-develUpgrade postgresql16-private-develUpgrade postgresql16-plpython3Upgrade postgresql16-contrib-debuginfoUpgrade postgresql16-upgrade-debuginfoUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql16-serverUpgrade postgresql15-debuginfoUpgrade postgresql15-llvmjitUpgrade postgresql16-upgrade-devel-debuginfoUpgrade postgresql16-debugsourceUpgrade postgresql15-docsUpgrade postgresql16Upgrade postgresql16-llvmjit-debuginfoUpgrade postgresql15-contribUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-plpython3Upgrade postgresql15-docs-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-serverUpgrade postgresql16-private-libsUpgrade postgresql16-upgradeUpgrade postgresql15-debugsourceUpgrade postgresql16-contribUpgrade postgresql15-pltclUpgrade postgresql16-private-libs-debuginfoUpgrade postgresql16-plperlUpgrade postgresql15-upgradeUpgrade postgresql15-plperl-debuginfoUpgrade postgresql16-pltcl-debuginfoUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql16-upgrade-develUpgrade postgresql16-test-rpm-macrosUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-testUpgrade postgresql15Upgrade postgresql16-docsUpgrade postgresql15-private-develUpgrade postgresql16-testUpgrade postgresql16-plperl-debuginfoUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql16-server-devel-debuginfoUpgrade postgresql16-plpython3-debuginfoUpgrade postgresql16-llvmjitUpgrade postgresql16-docs-debuginfoUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-staticUpgrade postgresql15-test-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql15-plperlUpgrade postgresql16-test-debuginfoUpgrade postgresql16-staticUpgrade postgresql15-server-develUpgrade postgresql16-server-develUpgrade postgresql16-debuginfoUpgrade postgresql16-server-debuginfoUpgrade postgresql16-pltclUpgrade postgresql15-private-libs | Feb 17, 2025 | Nov 14, 2024 |
| Debian | — | Upgrade postgresql-13Upgrade postgresql-15Upgrade postgresql-17 | Nov 18, 2024 | Nov 14, 2024 |
| Dell Powerstore Dsa2025342 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Freebsd | — | Upgrade postgresql17-plperlUpgrade postgresql12-plperlUpgrade postgresql15-plperlUpgrade postgresql16-plperlUpgrade postgresql14-plperlUpgrade postgresql13-plperl | Nov 15, 2024 | Nov 14, 2024 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Dec 9, 2024 | Nov 14, 2024 |
| Oracle_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade pgvectorUpgrade postgresql-upgradeUpgrade postgres-decoderbufsUpgrade postgresql-develUpgrade postgresql-upgrade-develUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-plpython3Upgrade postgresql-server-develUpgrade postgresql-staticUpgrade postgresql-private-develUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-serverUpgrade pg_repackUpgrade postgresql-plperlUpgrade postgresql-private-libsUpgrade pgaudit | Dec 5, 2024 | Nov 14, 2024 |
| Postgres | — | Upgrade to PostgreSQL version 16.5Upgrade to PostgreSQL version 15.9Upgrade to PostgreSQL version 17.1Upgrade to PostgreSQL version 14.14 | Nov 15, 2024 | Nov 14, 2024 |
| Redhat_linux | — | Upgrade postgresql-plpythonUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufsUpgrade pg_repack-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgresql-upgrade-develUpgrade pgaudit-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade pgvector-debuginfoUpgrade postgresql-private-develUpgrade pg_repack-debugsourceUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-develUpgrade postgresql-pltclUpgrade pgvector-debugsourceUpgrade pgauditUpgrade postgresql-server-develUpgrade pgvectorUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-private-libsNo solution existsUpgrade postgresql-plperlUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-staticUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-server-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-docsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-serverUpgrade pg_repackUpgrade postgresql-docs-debuginfo | Feb 10, 2025 | Nov 14, 2024 |
| Rocky_linux | — | Upgrade postgresql-docs-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade postgresql-serverUpgrade postgresql-staticUpgrade postgresql-plperlUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-debuginfoUpgrade postgresqlUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-pltclUpgrade pg_repack-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-debugsourceUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-private-libsUpgrade postgres-decoderbufsUpgrade pg_repackUpgrade postgresql-private-develUpgrade pgauditUpgrade pg_repack-debuginfo | Feb 5, 2026 | Dec 19, 2024 |
| Suse | — | Upgrade postgresql15-pltclUpgrade postgresql17-testUpgrade postgresqlUpgrade postgresql12-testUpgrade postgresql15-plperlUpgrade postgresql17-plperlUpgrade postgresql13-llvmjit-develUpgrade postgresql14-docsUpgrade postgresql-docsUpgrade postgresql13Upgrade postgresql14-llvmjit-develUpgrade postgresql14-testUpgrade postgresql17-llvmjitUpgrade postgresql12-contribUpgrade postgresql13-plperlUpgrade postgresql16-plperlUpgrade postgresql13-serverUpgrade postgresql14-server-develUpgrade postgresql15-develUpgrade postgresql17-docsUpgrade postgresql16-docsUpgrade postgresql-plperlUpgrade postgresql14-serverUpgrade postgresql17Upgrade postgresql13-llvmjitUpgrade postgresql14-plpythonUpgrade postgresql-serverUpgrade postgresql17-contribUpgrade libpq5Upgrade postgresql15Upgrade postgresql12Upgrade postgresql16-develUpgrade postgresql15-testUpgrade postgresql14-pltclUpgrade postgresql13-pltclUpgrade postgresql-testUpgrade postgresql15-plpythonUpgrade postgresql13-contribUpgrade postgresql12-server-develUpgrade postgresql15-contribUpgrade postgresql12-plpythonUpgrade postgresql15-llvmjit-develUpgrade postgresql17-plpythonUpgrade libecpg6-32bitUpgrade postgresql12-develUpgrade postgresql12-llvmjitUpgrade postgresql17-pltclUpgrade postgresql13-testUpgrade postgresql16-serverUpgrade postgresql14-develUpgrade postgresql14-plperlUpgrade postgresql16-server-develUpgrade postgresql13-plpythonUpgrade libpq5-32bitUpgrade postgresql17-serverUpgrade postgresql16Upgrade postgresql-llvmjitUpgrade postgresql13-docsUpgrade postgresql13-develUpgrade postgresql12-pltclUpgrade postgresql12-docsUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-llvmjit-develUpgrade postgresql-develUpgrade postgresql17-server-develUpgrade postgresql16-llvmjitUpgrade postgresql15-serverUpgrade postgresql12-plperlUpgrade postgresql16-testUpgrade postgresql17-llvmjit-develUpgrade postgresql-contribUpgrade postgresql16-pltclUpgrade postgresql15-server-develUpgrade postgresql15-llvmjitUpgrade postgresql14-llvmjitUpgrade postgresql14Upgrade postgresql12-llvmjit-develUpgrade postgresql13-server-develUpgrade postgresql16-plpythonUpgrade postgresql16-contribUpgrade postgresql15-docsUpgrade postgresql12-serverUpgrade postgresql-server-develUpgrade postgresql17-develUpgrade libecpg6Upgrade postgresql16-llvmjit-develUpgrade postgresql14-contrib | Dec 31, 2024 | Nov 14, 2024 |
| Ubuntu | — | Upgrade postgresql-client-16Upgrade postgresql-client-12Upgrade postgresql-client-9.5 (Ubuntu Pro)Upgrade postgresql-9.5 (Ubuntu Pro)Upgrade postgresql-client-14Upgrade postgresql-16Upgrade postgresql-12Upgrade postgresql-14 | Dec 3, 2024 | Nov 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 14, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub