RLSA-2024:10832

Important: postgresql:13 security update

No scoreFix available

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978)
postgresql: PostgreSQL PL/Perl environment variable changes execute arbitrary code (CVE-2024-10979)
postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes (CVE-2024-10976)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

What each source reports

OSV No score

Important: postgresql:13 security update

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978)
postgresql: PostgreSQL PL/Perl environment variable changes execute arbitrary code (CVE-2024-10979)
postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes (CVE-2024-10976)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2024:10832
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`pgaudit` Rocky Linux:8	before 0:1.5.0-1.module+el8.9.0+1594+4a6adae9	0:1.5.0-1.module+el8.9.0+1594+4a6adae9
`pg_repack` Rocky Linux:8	before 0:1.4.6-3.module+el8.10.0+1862+29bef648	0:1.4.6-3.module+el8.10.0+1862+29bef648
`postgres-decoderbufs` Rocky Linux:8	before 0:0.10.0-2.module+el8.10.0+1862+29bef648	0:0.10.0-2.module+el8.10.0+1862+29bef648
`postgresql` Rocky Linux:8	before 0:13.18-1.module+el8.10.0+1898+8409d9ae	0:13.18-1.module+el8.10.0+1898+8409d9ae

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

RLSA-2024:10832 is a vulnerability with no CVSS score yet in postgresql, published December 19, 2024. No source lists public exploit code. Fixed in pgaudit 0:1.5.0-1.module+el8.9.0+1594+4a6adae9.