CVE-2024-10978

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-10978", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2024-11-07T19:27:03.860Z", "datePublished": "2024-11-14T13:00:07.398Z", "dateUpdated": "2025-11-03T21:51:39.867Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2024-11-14T13:00:07.398Z"}, "title": "PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID", "descriptions": [{"lang": "en", "value": "Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected."}], "affected": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "17.1", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.5", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.9", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.14", "status": "affected", "version": "14", "versionType": "rpm"}, {"lessThan": "13.17", "status": "affected", "version": "13", "versionType": "rpm"}, {"lessThan": "12.21", "status": "affected", "version": "0", "versionType": "rpm"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-266", "type": "CWE", "description": "Incorrect Privilege Assignment"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2024-10978/"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 4.2, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Tom Lane for reporting this problem."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-14T18:53:38.409914Z", "id": "CVE-2024-10978", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-14T19:29:16.719Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://www.postgresql.org/message-id/173171334532.1547978.1518068370217143844%40wrigleys.postgresql.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00018.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:51:39.867Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.postgresql.org/message-id/173171334532.1547978.1518068370217143844%40wrigleys.postgresql.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00018.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:51:39.867Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-10978", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-14T18:53:38.409914Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-14T18:54:19.728Z"}}], "cna": {"title": "PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID", "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Tom Lane for reporting this problem."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 4.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "n/a", "product": "PostgreSQL", "versions": [{"status": "affected", "version": "17", "lessThan": "17.1", "versionType": "rpm"}, {"status": "affected", "version": "16", "lessThan": "16.5", "versionType": "rpm"}, {"status": "affected", "version": "15", "lessThan": "15.9", "versionType": "rpm"}, {"status": "affected", "version": "14", "lessThan": "14.14", "versionType": "rpm"}, {"status": "affected", "version": "13", "lessThan": "13.17", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "12.21", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2024-10978/"}], "descriptions": [{"lang": "en", "value": "Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2024-11-14T13:00:07.398Z"}}}, "cveMetadata": {"cveId": "CVE-2024-10978", "state": "PUBLISHED", "dateUpdated": "2025-11-03T21:51:39.867Z", "dateReserved": "2024-11-07T19:27:03.860Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2024-11-14T13:00:07.398Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "17.1", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.5", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.9", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.14", "status": "affected", "version": "14", "versionType": "rpm"}, {"lessThan": "13.17", "status": "affected", "version": "13", "versionType": "rpm"}, {"lessThan": "12.21", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "433D59A0-8811-4DDB-A9F7-D85C62F905CC", "versionEndExcluding": "12.21", "versionStartIncluding": "12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "380F8048-FBE5-4606-93A3-915CFD229317", "versionEndExcluding": "13.17", "versionStartIncluding": "13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "FACF31C7-3B20-4BAE-A596-9C59D67406D8", "versionEndExcluding": "14.14", "versionStartIncluding": "14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "DF12F1A2-3179-4DAC-B728-038B94954DC7", "versionEndExcluding": "15.9", "versionStartIncluding": "15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "353CBD91-FC28-4DA3-B79A-F4F4DC80FA93", "versionEndExcluding": "16.5", "versionStartIncluding": "16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:17.0:-:*:*:*:*:*:*", "matchCriteriaId": "554F297F-6688-4242-9618-40A3A017D246", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:17.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "2012E2E6-9A7A-4EA8-AE7C-5CB3486CE9DA", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:17.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "354785D4-62F8-49C6-BFE6-D7AFEF7BE28F", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:17.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "EB5B99AA-AEDF-4730-824E-3A09D47B19DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:17.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "9C88EECA-C66E-4FCF-BA4A-7581516B2471", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected."}, {"lang": "es", "value": "La asignaci\u00f3n incorrecta de privilegios en PostgreSQL permite que un usuario de la aplicaci\u00f3n con menos privilegios vea o cambie filas distintas a las previstas. Un ataque requiere que la aplicaci\u00f3n utilice SET ROLE, SET SESSION AUTHORIZATION o una funci\u00f3n equivalente. El problema surge cuando una consulta de la aplicaci\u00f3n utiliza par\u00e1metros del atacante o transmite los resultados de la consulta al atacante. Si esa consulta reacciona a current_setting('role') o al ID de usuario actual, puede modificar o devolver datos como si la sesi\u00f3n no hubiera utilizado SET ROLE o SET SESSION AUTHORIZATION. El atacante no controla qu\u00e9 ID de usuario incorrecto se aplica. El texto de la consulta de fuentes con menos privilegios no es un problema aqu\u00ed, porque SET ROLE y SET SESSION AUTHORIZATION no son entornos aislados para consultas no verificadas. Las versiones anteriores a PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17 y 12.21 se ven afectadas."}], "id": "CVE-2024-10978", "lastModified": "2026-06-17T06:56:49.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.5, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-10978", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-11-14T18:53:38.409914Z", "version": "2.0.3"}}]}, "published": "2024-11-14T13:15:04.217", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "tags": ["Vendor Advisory"], "url": "https://www.postgresql.org/support/security/CVE-2024-10978/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00018.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://www.postgresql.org/message-id/173171334532.1547978.1518068370217143844%40wrigleys.postgresql.org"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:10785", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "postgresql:12-8100020241122084405.489197e6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-12-04T00:00:00Z"}, {"advisory": "RHSA-2024:10830", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "postgresql:15-8100020241122084744.489197e6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10831", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "postgresql:16-8100020241122085009.489197e6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10832", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "postgresql:13-8100020241122084628.489197e6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10787", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "postgresql:15-9050020241122141928.rhel9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-12-04T00:00:00Z"}, {"advisory": "RHSA-2024:10788", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "postgresql:16-9050020241122142517.rhel9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-12-04T00:00:00Z"}, {"advisory": "RHSA-2024:10791", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "postgresql-0:13.18-1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-12-04T00:00:00Z"}], "bugzilla": {"description": "postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID", "id": "2326251", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2326251"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "verified"}, "cwe": "CWE-266", "details": ["Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.", "A flaw was found in PostgreSQL. This vulnerability allows a less-privileged application user to view or change unintended rows using SET ROLE, SET SESSION AUTHORIZATION, or equivalent features resulting in loss of confidentiality integrity and availability."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-10978", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "postgresql", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2024-11-14T13:00:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-10978\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-10978\nhttps://www.postgresql.org/support/security/CVE-2024-10978/"], "statement": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-266: and therefore downgrades the severity of this particular CVE from Moderate to Low.\nAccess to the platform is granted only after successful hard token, multi-factor authentication (MFA), which is coupled with least privilege principles to ensure that only authorized roles and users can execute or manipulate code. Additionally, the platform's built-in Role-Based Access Control (RBAC) enforces least privilege across workloads. Red Hat enforces the principle of least functionality, ensuring that only essential features, services, and ports are enabled. Event logs are collected and processed for centralization, correlation, analysis, monitoring, reporting, alerting, and retention, which helps detect and alert of any anomalous or unauthorized activity. Finally, process isolation ensures that compromised components are contained within the originating process, preventing it from affecting other processes or the system as a whole.", "threat_severity": "Moderate"}

{}