{"id":"RLSA-2024:10832","aliases":[],"status":"published","title":"Important: postgresql:13 security update","description":"PostgreSQL is an advanced object-relational database management system (DBMS).\n\nSecurity Fix(es):\n\n* postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978)\n\n* postgresql: PostgreSQL PL/Perl environment variable changes execute arbitrary code (CVE-2024-10979)\n\n* postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes (CVE-2024-10976)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-12-19T04:18:05.672002Z","modified":"2026-02-05T10:07:10Z","fixes":[{"ecosystem":"Rocky Linux:8","package":"pgaudit","fixed_in":["0:1.5.0-1.module+el8.9.0+1594+4a6adae9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"pg_repack","fixed_in":["0:1.4.6-3.module+el8.10.0+1862+29bef648"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"postgres-decoderbufs","fixed_in":["0:0.10.0-2.module+el8.10.0+1862+29bef648"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"postgresql","fixed_in":["0:13.18-1.module+el8.10.0+1898+8409d9ae"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Rocky Linux:8","package":"pgaudit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-1.module+el8.9.0+1594+4a6adae9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pg_repack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.6-3.module+el8.10.0+1862+29bef648"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"postgres-decoderbufs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.0-2.module+el8.10.0+1862+29bef648"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.18-1.module+el8.10.0+1898+8409d9ae"}]}]}],"references":[{"url":"https://errata.rockylinux.org/RLSA-2024:10832","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326251","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326253","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326263","tags":["report"]}],"sources":{"osv":[{"id":"RLSA-2024:10832","title":"Important: postgresql:13 security update","description":"PostgreSQL is an advanced object-relational database management system (DBMS).\n\nSecurity Fix(es):\n\n* postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978)\n\n* postgresql: PostgreSQL PL/Perl environment variable changes execute arbitrary code (CVE-2024-10979)\n\n* postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes (CVE-2024-10976)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-12-19T04:18:05.672002Z","modified":"2026-02-05T10:07:10.086126Z","updated_at":"2026-11-02T15:53:24.63379Z"}]}}