CVE-2024-7348
published 2024-08-08CVE-2024-7348: Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running…
PriorityP352high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
1.57%
72.5th percentile
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | postgresql-13 | < postgresql-13 13.16-0+deb11u1 (bullseye) | postgresql-13 13.16-0+deb11u1 (bullseye) |
| debian | postgresql-15 | < postgresql-13 13.16-0+deb11u1 (bullseye) | postgresql-13 13.16-0+deb11u1 (bullseye) |
| msrc | azl3_postgresql_16.3-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_postgresql_16.4-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_postgresql_14.12-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_postgresql_14.13-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| postgresql | postgresql | < 12.20 | 12.20 |
| postgresql | postgresql | >= 12.0 < 12.20 | 12.20 |
| postgresql | postgresql | >= 13 < 13.16 | 13.16 |
| postgresql | postgresql | >= 13.0 < 13.16 | 13.16 |
| postgresql | postgresql | >= 14 < 14.13 | 14.13 |
| postgresql | postgresql | >= 14.0 < 14.13 | 14.13 |
| postgresql | postgresql | >= 15 < 15.8 | 15.8 |
| postgresql | postgresql | >= 15.0 < 15.8 | 15.8 |
| postgresql | postgresql | >= 16 < 16.4 | 16.4 |
| postgresql | postgresql | >= 16.0 < 16.4 | 16.4 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.5HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
vendor_msrc7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python3.5, python3.8 regression
osv·2025-03-24·CVSS 6.3
python3.5, python3.8 regression
python3.5, python3.8 regression
USN-7348-1 fixed vulnerabilities in Python. The update introduced a
regression. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Python ipaddress module contained incorrect
information about which IP address ranges were considered “private” or
“globally reachable”. This could possibly result in applications applying
incorrect security policies. This issue only affected Ubuntu 14.04 LTS
and Ubuntu 16.04 LTS. (CVE-2024-4032)
It was discovered that Python incorrectly handled quoting path names when
using the venv module. A local attacker able to control virtual
environments could possibly use this issue to execute arbitrary code when
the virtual environment is activated. (CVE-2024-9287
OSV
postgresql-10, postgresql-9.3 vulnerability
osv·2024-10-14·CVSS 7.5
CVE-2024-7348 [HIGH] postgresql-10, postgresql-9.3 vulnerability
postgresql-10, postgresql-9.3 vulnerability
USN-6968-1 fixed CVE-2024-7348 in PostgreSQL-12, PostgreSQL-14, and
PostgreSQL-16.
This update provides the corresponding updates for PostgreSQL-9.3 in
Ubuntu 14.04 LTS and PostgreSQL-10 in Ubuntu 18.04 LTS.
Original advisory details:
Noah Misch discovered that PostgreSQL incorrectly handled certain
SQL objects. An attacker could possibly use this issue to execute
arbitrary SQL functions as the superuser.
OSV
postgresql-9.5 vulnerability
osv·2024-09-19·CVSS 7.5
CVE-2024-7348 [HIGH] postgresql-9.5 vulnerability
postgresql-9.5 vulnerability
USN-6968-1 fixed CVE-2024-7348 in PostgreSQL-12, PostgreSQL-14, and
PostgreSQL-16
This update provides the corresponding updates for PostgreSQL-9.5 in
Ubuntu 16.04 LTS.
Original advisory details:
Noah Misch discovered that PostgreSQL incorrectly handled certain
SQL objects. An attacker could possibly use this issue to execute
arbitrary SQL functions as the superuser.
GHSA
GHSA-3c6g-7v4g-5xcm: Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user run
ghsa_unreviewed·2024-08-08
CVE-2024-7348 [HIGH] CWE-367 GHSA-3c6g-7v4g-5xcm: Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user run
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.
OSV
CVE-2024-7348: Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user run
osv·2024-08-08·CVSS 7.5
CVE-2024-7348 [HIGH] CVE-2024-7348: Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user run
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.
Ubuntu
PostgreSQL vulnerability
vendor_ubuntu·2024-10-14·CVSS 8.8
CVE-2024-7348 [HIGH] PostgreSQL vulnerability
Title: PostgreSQL vulnerability
Summary: PostgreSQL could execute arbitrary SQL functions as the superuser
if it received a specially crafted SQL object.
USN-6968-1 fixed CVE-2024-7348 in PostgreSQL-12, PostgreSQL-14, and
PostgreSQL-16.
This update provides the corresponding updates for PostgreSQL-9.3 in
Ubuntu 14.04 LTS and PostgreSQL-10 in Ubuntu 18.04 LTS.
Original advisory details:
Noah Misch discovered that PostgreSQL incorrectly handled certain
SQL objects. An attacker could possibly use this issue to execute
arbitrary SQL functions as the superuser.
Instructions: After a standard system update you need to restart PostgreSQL to
make all the necessary changes.
Ubuntu
PostgreSQL vulnerability
vendor_ubuntu·2024-09-19·CVSS 8.8
CVE-2024-7348 [HIGH] PostgreSQL vulnerability
Title: PostgreSQL vulnerability
Summary: PostgreSQL could execute arbitrary SQL functions as the superuser
if it received a specially crafted SQL object.
USN-6968-1 fixed CVE-2024-7348 in PostgreSQL-12, PostgreSQL-14, and
PostgreSQL-16
This update provides the corresponding updates for PostgreSQL-9.5 in
Ubuntu 16.04 LTS.
Original advisory details:
Noah Misch discovered that PostgreSQL incorrectly handled certain
SQL objects. An attacker could possibly use this issue to execute
arbitrary SQL functions as the superuser.
Instructions: After a standard system update you need to restart PostgreSQL to
make all the necessary changes.
Ubuntu
PostgreSQL vulnerability
vendor_ubuntu·2024-08-19
CVE-2024-7348 PostgreSQL vulnerability
Title: PostgreSQL vulnerability
Summary: PostgreSQL could execute arbitrary SQL functions as the superuser
if it received a specially crafted SQL object.
Noah Misch discovered that PostgreSQL incorrectly handled certain
SQL objects. An attacker could possibly use this issue to execute
arbitrary SQL functions as the superuser.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.
Microsoft
PostgreSQL relation replacement during pg_dump executes arbitrary SQL
vendor_msrc·2024-08-13·CVSS 7.5
CVE-2024-7348 [HIGH] CWE-367 PostgreSQL relation replacement during pg_dump executes arbitrary SQL
PostgreSQL relation replacement during pg_dump executes arbitrary SQL
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
PostgreSQL: PostgreSQL
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Red Hat
postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL
vendor_redhat·2024-08-08·CVSS 8.8
CVE-2024-7348 [HIGH] CWE-367 postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL
postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.
A vulnerability was found in PostgreSQL. A Race condition in pg_dump allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser.
Statement: Satellite PostgreSQL is pulled
Debian
CVE-2024-7348: postgresql-13 - Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allow...
vendor_debian·2024·CVSS 8.8
CVE-2024-7348 [HIGH] CVE-2024-7348: postgresql-13 - Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allow...
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.
Scope: local
bullseye: resolved (fixed in 13.16-0+deb11u1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-08-08
Published