CVE-2024-10979
Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH ). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected. The PostgreSQL project thanks Coby Abrams for reporting this problem.
Version Information
| Affected branch | Introduced | Fixed In | Fix Published |
|---|---|---|---|
| 12 | — | 12.21 | 2024-11-14 |
| 13 | — | 13.17 | 2024-11-14 |
| 14 | — | 14.14 | 2024-11-14 |
| 15 | — | 15.9 | 2024-11-14 |
| 16 | — | 16.5 | 2024-11-14 |
| 17 | — | 17.1 | 2024-11-14 |
CVSS 3.0
| Overall Score | 8.8 |
|---|---|
| Component | core server |
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
First published: 2024-11-14
Historical source observations
These dated records preserve the original source claims separately from the reviewed fix list.
center · 2026-10-03 12:08:35.169032+08
- PostgreSQL 17 · Original minor coordinate: 1
- PostgreSQL 16 · Original minor coordinate: 5
- PostgreSQL 15 · Original minor coordinate: 9
- PostgreSQL 14 · Original minor coordinate: 14
pgweb · 2026-10-03 12:08:55.967155+08
- PostgreSQL 17 · Original minor coordinate: 1
- PostgreSQL 16 · Original minor coordinate: 5
- PostgreSQL 15 · Original minor coordinate: 9
- PostgreSQL 14 · Original minor coordinate: 14