CVE-2024-10979
MediumSummary
Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g., PATH). This often suffices for arbitrary code execution, even without a database server OS user account.
Risk Assessment
An unprivileged database user can achieve remote code execution on the server, leading to full system compromise.
Recommendation
Update PostgreSQL to the patched version and restrict PL/Perl usage to trusted users.
Original NVD description (English source)
Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions