Read the docs
TI-2024-10176 Aliases CVE-2024-10978GHSA-37v9-jh5m-f5pg

PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID

Priority LOW 21CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Privilege escalation
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-266.

Summary

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0069 53rd percentileScored 2026-11-07
Fix Partial PostgreSQL: 17.1, 16.5, 15.9 +3Red Hat: 7 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—PostgreSQL17 to before 17.1; 16 to before 16.5; 15 to before 15.9; 14 to before 14.14; 13 to before 13.17; before 12.2117.1, 16.5, 15.9, 14.14, 13.17, 12.21Patch availableCNA
  • PostgreSQL Vendor— Affected 17 to before 17.1; 16 to before 16.5; 15 to before 15.9; 14 to before 14.14; 13 to before 13.17; before 12.21 Fixed in 17.1, 16.5, 15.9, 14.14, 13.17, 12.21 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*12.0 to before 12.21; 13.0 to before 13.17; 14.0 to before 14.14; 15.0 to before 15.9; 16.0 to before 16.5VulnerablePostgreSQL
cpe:2.3:a:postgresql:postgresql:17.0:-:*:*:*:*:*:*17.0VulnerablePostgreSQL
cpe:2.3:a:postgresql:postgresql:17.0:beta1:*:*:*:*:*:*17.0 beta1VulnerablePostgreSQL
cpe:2.3:a:postgresql:postgresql:17.0:beta2:*:*:*:*:*:*17.0 beta2VulnerablePostgreSQL
cpe:2.3:a:postgresql:postgresql:17.0:beta3:*:*:*:*:*:*17.0 beta3VulnerablePostgreSQL
cpe:2.3:a:postgresql:postgresql:17.0:rc1:*:*:*:*:*:*17.0 rc1VulnerablePostgreSQL
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions 12.0 to before 12.21; 13.0 to before 13.17; 14.0 to before 14.14; 15.0 to before 15.9; 16.0 to before 16.5 Vulnerable ·PostgreSQL
  • cpe:2.3:a:postgresql:postgresql:17.0:-:*:*:*:*:*:* Versions 17.0 Vulnerable ·PostgreSQL
  • cpe:2.3:a:postgresql:postgresql:17.0:beta1:*:*:*:*:*:* Versions 17.0 beta1 Vulnerable ·PostgreSQL
  • cpe:2.3:a:postgresql:postgresql:17.0:beta2:*:*:*:*:*:* Versions 17.0 beta2 Vulnerable ·PostgreSQL
  • cpe:2.3:a:postgresql:postgresql:17.0:beta3:*:*:*:*:*:* Versions 17.0 beta3 Vulnerable ·PostgreSQL
  • cpe:2.3:a:postgresql:postgresql:17.0:rc1:*:*:*:*:*:* Versions 17.0 rc1 Vulnerable ·PostgreSQL
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA PostgreSQL Fixed in 17.1, 16.5, 15.9, 14.14, 13.17, 12.21

Red Hat 7 advisories

  • RHSA-2024:10831 Released 2024-12-05 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.s390x::postgresql:16 +47
  • RHSA-2024:10832 Released 2024-12-05 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.s390x::postgresql:13 +47
  • RHSA-2024:10830 Released 2024-12-05 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.s390x::postgresql:15 +47
Show 4 more Red Hat advisories
  • RHSA-2024:10791 Released 2024-12-04 · Red Hat rating Important
    postgresql security update
    • Red Hat CodeReady Linux Builder (v. 9) postgresql-docs-13.18-1.el9_5, postgresql-private-devel-13.18-1.el9_5, postgresql-server-devel-13.18-1.el9_5 +4
    • Red Hat Enterprise Linux AppStream (v. 9) postgresql-13.18-1.el9_5, postgresql-contrib-13.18-1.el9_5, postgresql-plperl-13.18-1.el9_5 +5
  • RHSA-2024:10788 Released 2024-12-04 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.5.1-1.module+el9.5.0+22557+8cb08ba5.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el9.5.0+22557+8cb08ba5.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el9.5.0+22557+8cb08ba5.s390x::postgresql:16 +47
  • RHSA-2024:10787 Released 2024-12-04 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.aarch64::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.ppc64le::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.s390x::postgresql:15 +47
  • RHSA-2024:10785 Released 2024-12-04 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.aarch64::postgresql:12, pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.s390x::postgresql:12 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PostgreSQL 12.21, 13.17 and 4 more versions

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2024-10177 PostgreSQL PL/Perl environment variable changes execute arbitrary codePriority MEDIUM 47
    • TI-2024-10174 PostgreSQL row security below e.g. subqueries disregards user ID changesPriority LOW 26
    • TI-2024-10175 PostgreSQL libpq retains an error message from man-in-the-middlePriority LOW 18
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat CodeReady Linux Builder (v. 9)Fixed RHSA-2024:10791
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:10785, RHSA-2024:10830, RHSA-2024:10831, RHSA-2024:10832
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:10787, RHSA-2024:10788, RHSA-2024:10791

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10978
  2. 2026-10-03 Alias added: GHSA-37v9-jh5m-f5pg

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences