CVE-2024-10978
published 2024-11-14CVE-2024-10978: Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires…
PriorityP422medium4.2CVSS 3.1
AVNACHPRLUINSUCLILAN
EPSS
0.70%
49.3th percentile
Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | postgresql-13 | < postgresql-13 13.17-0+deb11u1 (bullseye) | postgresql-13 13.17-0+deb11u1 (bullseye) |
| debian | postgresql-15 | < postgresql-13 13.17-0+deb11u1 (bullseye) | postgresql-13 13.17-0+deb11u1 (bullseye) |
| debian | postgresql-17 | < postgresql-13 13.17-0+deb11u1 (bullseye) | postgresql-13 13.17-0+deb11u1 (bullseye) |
| msrc | azl3_postgresql_16.4-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_postgresql_16.5-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_postgresql_14.13-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_postgresql_14.14-1_on_cbl_mariner_2.0 | — | — |
| postgresql | postgresql | < 12.21 | 12.21 |
| postgresql | postgresql | — | — |
| postgresql | postgresql | >= 12.0 < 12.21 | 12.21 |
| postgresql | postgresql | >= 13 < 13.17 | 13.17 |
| postgresql | postgresql | >= 13.0 < 13.17 | 13.17 |
| postgresql | postgresql | >= 14 < 14.14 | 14.14 |
| postgresql | postgresql | >= 14.0 < 14.14 | 14.14 |
| postgresql | postgresql | >= 15 < 15.9 | 15.9 |
| postgresql | postgresql | >= 15.0 < 15.9 | 15.9 |
| postgresql | postgresql | >= 16 < 16.5 | 16.5 |
| postgresql | postgresql | >= 16.0 < 16.5 | 16.5 |
| postgresql | postgresql | >= 17 < 17.1 | 17.1 |
CVSS provenance
nvdv3.14.2MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
osv5.4MEDIUM
vendor_debian4.2MEDIUM
vendor_msrc4.2MEDIUM
vendor_redhat4.2MEDIUM
vendor_ubuntu4.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PostgreSQL vulnerabilities
vendor_ubuntu·2025-03-19·CVSS 4.2
CVE-2024-10976 [MEDIUM] PostgreSQL vulnerabilities
Title: PostgreSQL vulnerabilities
Summary: Several security issues were fixed in PostgreSQL.
Wolfgang Walther discovered that PostgreSQL incorrectly tracked tables with
row security. A remote attacker could possibly use this issue to perform
forbidden reads and modifications. (CVE-2024-10976)
Jacob Champion discovered that PostgreSQL clients used untrusted server
error messages. An attacker that is able to intercept network
communications could possibly use this issue to inject error messages that
could be interpreted as valid query results. (CVE-2024-10977)
Tom Lane discovered that PostgreSQL incorrectly handled certain privilege
assignments. A remote attacker could possibly use this issue to view or
change different rows from those intended. (CVE-2024-10978)
Coby Abrams discovered t
Ubuntu
PostgreSQL vulnerabilities
vendor_ubuntu·2024-12-02·CVSS 4.2
CVE-2024-10978 [MEDIUM] PostgreSQL vulnerabilities
Title: PostgreSQL vulnerabilities
Summary: Several security issues were fixed in PostgreSQL.
It was discovered that PostgreSQL incorrectly tracked tables with row
security. A remote attacker could possibly use this issue to perform
forbidden reads and modifications. (CVE-2024-10976)
Jacob Champion discovered that PostgreSQL clients used untrusted server
error messages. An attacker that is able to intercept network
communications could possibly use this issue to inject error messages that
could be interpreted as valid query results. (CVE-2024-10977)
Tom Lane discovered that PostgreSQL incorrectly handled certain privilege
assignments. A remote attacker could possibly use this issue to view or
change different rows from those intended. (CVE-2024-10978)
Coby Abrams discovered that Postgr
Red Hat
postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID
vendor_redhat·2024-11-14·CVSS 4.2
CVE-2024-10978 [MEDIUM] CWE-266 postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID
postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID
Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION ar
Microsoft
PostgreSQL SET ROLE SET SESSION AUTHORIZATION reset to wrong user ID
vendor_msrc·2024-11-12·CVSS 4.2
CVE-2024-10978 [MEDIUM] CWE-266 PostgreSQL SET ROLE SET SESSION AUTHORIZATION reset to wrong user ID
PostgreSQL SET ROLE SET SESSION AUTHORIZATION reset to wrong user ID
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
PostgreSQL: PostgreSQL
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
R
Debian
CVE-2024-10978: postgresql-13 - Incorrect privilege assignment in PostgreSQL allows a less-privileged applicatio...
vendor_debian·2024·CVSS 4.2
CVE-2024-10978 [MEDIUM] CVE-2024-10978: postgresql-13 - Incorrect privilege assignment in PostgreSQL allows a less-privileged applicatio...
Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9,
OSV
postgresql-9.5 vulnerabilities
osv·2025-03-19·CVSS 5.4
CVE-2024-10976 [MEDIUM] postgresql-9.5 vulnerabilities
postgresql-9.5 vulnerabilities
Wolfgang Walther discovered that PostgreSQL incorrectly tracked tables with
row security. A remote attacker could possibly use this issue to perform
forbidden reads and modifications. (CVE-2024-10976)
Jacob Champion discovered that PostgreSQL clients used untrusted server
error messages. An attacker that is able to intercept network
communications could possibly use this issue to inject error messages that
could be interpreted as valid query results. (CVE-2024-10977)
Tom Lane discovered that PostgreSQL incorrectly handled certain privilege
assignments. A remote attacker could possibly use this issue to view or
change different rows from those intended. (CVE-2024-10978)
Coby Abrams discovered that PostgreSQL incorrectly handled environment
variables. A rem
OSV
postgresql-12, postgresql-14, postgresql-16 vulnerabilities
osv·2024-12-02·CVSS 5.4
CVE-2024-10976 [MEDIUM] postgresql-12, postgresql-14, postgresql-16 vulnerabilities
postgresql-12, postgresql-14, postgresql-16 vulnerabilities
It was discovered that PostgreSQL incorrectly tracked tables with row
security. A remote attacker could possibly use this issue to perform
forbidden reads and modifications. (CVE-2024-10976)
Jacob Champion discovered that PostgreSQL clients used untrusted server
error messages. An attacker that is able to intercept network
communications could possibly use this issue to inject error messages that
could be interpreted as valid query results. (CVE-2024-10977)
Tom Lane discovered that PostgreSQL incorrectly handled certain privilege
assignments. A remote attacker could possibly use this issue to view or
change different rows from those intended. (CVE-2024-10978)
Coby Abrams discovered that PostgreSQL incorrectly handled environme
OSV
CVE-2024-10978: Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended
osv·2024-11-14·CVSS 4.2
CVE-2024-10978 [MEDIUM] CVE-2024-10978: Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended
Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9,
GHSA
GHSA-37v9-jh5m-f5pg: Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended
ghsa_unreviewed·2024-11-14
CVE-2024-10978 [MEDIUM] CWE-266 GHSA-37v9-jh5m-f5pg: Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended
Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9,
No detection rules found.
No public exploits indexed.
2024-11-14
Published