{"id":6250,"date":"2024-11-14T15:53:19","date_gmt":"2024-11-14T21:53:19","guid":{"rendered":"https:\/\/www.darkreading.com\/vulnerabilities-threats\/varonis-warns-bug-discovered-postgresql-pl-perl"},"modified":"2024-11-14T15:53:19","modified_gmt":"2024-11-14T21:53:19","slug":"varonis-warns-of-bug-discovered-in-postgresql-pl-perl","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/11\/14\/varonis-warns-of-bug-discovered-in-postgresql-pl-perl\/","title":{"rendered":"Varonis Warns of Bug Discovered in PostgreSQL PL\/Perl"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

Researchers at Varonis discovered a vulnerability <\/span>within Postgres<\/a><\/span> language extension PL\/Perl, allowing a user to set arbitrary environment variables in PostgreSQL session processes.<\/span><\/p>\n

The vulnerability was given a CVSS 8.8 score for severity and could lead to severe security issues, depending on the scenario where it’s exploited.<\/span><\/p>\n

Tracked as CVE-2024-10979, the flaw allows a threat actor to modify a sensitive environment, ultimately allowing them to execute arbitrary code without accessing a user of the operating system.<\/span><\/p>\n

The vulnerability also allows a threat actor to run additional queries to gather information on the machine and its contents.<\/span><\/p>\n

Versions preceding <\/span>PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21<\/a><\/span> are affected by this vulnerability and can be mitigated by upgrading to PostgreSQL, “to the latest minor version at a minimum,” according to the researchers, as well as restricting allowed extensions.<\/span><\/p>\n

Postgres customers should also examine ddl logs for creation of functions they do not recognize or did not create themselves to assess if they have been impacted.<\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Researchers at Varonis discovered a vulnerability within Postgres language extension<\/p>\n","protected":false},"author":12,"featured_media":6251,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-6250","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/varonis-warns-of-bug-discovered-in-postgresql-pl-perl-scaled.jpg?fit=2560%2C1440&ssl=1",2560,1440,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/varonis-warns-of-bug-discovered-in-postgresql-pl-perl-scaled.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/varonis-warns-of-bug-discovered-in-postgresql-pl-perl-scaled.jpg?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/varonis-warns-of-bug-discovered-in-postgresql-pl-perl-scaled.jpg?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/varonis-warns-of-bug-discovered-in-postgresql-pl-perl-scaled.jpg?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/varonis-warns-of-bug-discovered-in-postgresql-pl-perl-scaled.jpg?fit=1536%2C864&ssl=1",1536,864,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/varonis-warns-of-bug-discovered-in-postgresql-pl-perl-scaled.jpg?fit=2048%2C1152&ssl=1",2048,1152,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/varonis-warns-of-bug-discovered-in-postgresql-pl-perl-scaled.jpg?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/varonis-warns-of-bug-discovered-in-postgresql-pl-perl-scaled.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/varonis-warns-of-bug-discovered-in-postgresql-pl-perl-scaled.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/varonis-warns-of-bug-discovered-in-postgresql-pl-perl-scaled.jpg?fit=2560%2C1440&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6250","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=6250"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6250\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/6251"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=6250"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=6250"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=6250"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}