{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "PostgreSQL ist eine frei verf\u00fcgbare Datenbank f\u00fcr unterschiedliche Betriebssysteme.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, Daten zu manipulieren oder vertrauliche Informationen preiszugeben.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3475 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3475.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3475 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3475"
      },
      {
        "category": "external",
        "summary": "PostgreSQL Release Notes vom 2024-11-14",
        "url": "https://www.postgresql.org/about/news/postgresql-171-165-159-1414-1317-and-1221-released-2955/"
      },
      {
        "category": "external",
        "summary": "PostgreSQL Security Advisory vom 2024-11-14",
        "url": "https://www.postgresql.org/support/security/CVE-2024-10976/"
      },
      {
        "category": "external",
        "summary": "PostgreSQL Security Advisory vom 2024-11-14",
        "url": "https://www.postgresql.org/support/security/CVE-2024-10977/"
      },
      {
        "category": "external",
        "summary": "PostgreSQL Security Advisory vom 2024-11-14",
        "url": "https://www.postgresql.org/support/security/CVE-2024-10978/"
      },
      {
        "category": "external",
        "summary": "PostgreSQL Security Advisory vom 2024-11-14",
        "url": "https://www.postgresql.org/support/security/CVE-2024-10979/"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-5812 vom 2024-11-16",
        "url": "https://lists.debian.org/debian-security-announce/2024/msg00226.html"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2024:14502-1 vom 2024-11-16",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AKWDFN2C7BDHNEIL7UAMUE2QLH322LIK/"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2024:14505-1 vom 2024-11-16",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RB4KENPNXIDYL7D4OSLN7SICCC2ASXXP/"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-3954 vom 2024-11-16",
        "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:4052-1 vom 2024-11-25",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-November/019843.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:4063-1 vom 2024-11-26",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/NM7DG2QZKFAKH2TVO6LI5MFXR43ZC4RC/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:4098-1 vom 2024-11-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-November/019869.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:4097-1 vom 2024-11-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-November/019870.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:4096-1 vom 2024-11-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-November/019871.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:4095-1 vom 2024-11-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-November/019872.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:4099-1 vom 2024-11-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-November/019868.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:4118-1 vom 2024-11-29",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/VBMMHVAJJCAP52ZFWBGECD6A3RO5GMX4/"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10593 vom 2024-12-02",
        "url": "https://access.redhat.com/errata/RHSA-2024:10593"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:4114-1 vom 2024-11-29",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-November/019874.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10595 vom 2024-12-02",
        "url": "https://access.redhat.com/errata/RHSA-2024:10595"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10705 vom 2024-12-02",
        "url": "https://access.redhat.com/errata/RHSA-2024:10705"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-7132-1 vom 2024-12-02",
        "url": "https://ubuntu.com/security/notices/USN-7132-1"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10677 vom 2024-12-02",
        "url": "https://access.redhat.com/errata/RHSA-2024:10677"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10739 vom 2024-12-03",
        "url": "https://access.redhat.com/errata/RHSA-2024:10739"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10788 vom 2024-12-04",
        "url": "https://access.redhat.com/errata/RHSA-2024:10788"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10787 vom 2024-12-04",
        "url": "https://access.redhat.com/errata/RHSA-2024:10787"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10785 vom 2024-12-04",
        "url": "https://access.redhat.com/errata/RHSA-2024:10785"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10750 vom 2024-12-03",
        "url": "https://access.redhat.com/errata/RHSA-2024:10750"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10789 vom 2024-12-04",
        "url": "https://access.redhat.com/errata/RHSA-2024:10789"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10800 vom 2024-12-04",
        "url": "https://access.redhat.com/errata/RHSA-2024:10800"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10827 vom 2024-12-05",
        "url": "https://access.redhat.com/errata/RHSA-2024:10827"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10807 vom 2024-12-04",
        "url": "https://access.redhat.com/errata/RHSA-2024:10807"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:4175-1 vom 2024-12-04",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LS2XLEBNB7SJ2N2QEBUANUTS7ORDE6SO/"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10831 vom 2024-12-05",
        "url": "https://access.redhat.com/errata/RHSA-2024:10831"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:4174-1 vom 2024-12-04",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/L5U7GLD2GHOAYD54LYIGZYYVWQYGYFRX/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:4176-1 vom 2024-12-04",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/DALTZPSAABBADG7HF56AU5UPFJAHAARO/"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10832 vom 2024-12-05",
        "url": "https://access.redhat.com/errata/RHSA-2024:10832"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:4173-1 vom 2024-12-04",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/5WIRX4CKTVOW2ASMEMI4CQRBL6C6VQJS/"
      },
      {
        "category": "external",
        "summary": "RedHat Security Advisory",
        "url": "https://access.redhat.com/errata/RHSA-2024:10791"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10830 vom 2024-12-05",
        "url": "https://access.redhat.com/errata/RHSA-2024:10830"
      }
    ],
    "source_lang": "en-US",
    "title": "PostgreSQL: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-12-04T23:00:00.000+00:00",
      "generator": {
        "date": "2024-12-05T10:11:11.921+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2024-3475",
      "initial_release_date": "2024-11-14T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-11-14T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-11-17T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Debian und openSUSE aufgenommen"
        },
        {
          "date": "2024-11-25T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2024-11-26T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2024-11-28T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2024-12-01T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von SUSE und Red Hat aufgenommen"
        },
        {
          "date": "2024-12-02T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat und Ubuntu aufgenommen"
        },
        {
          "date": "2024-12-03T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-12-04T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "9"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c17.1",
                "product": {
                  "name": "Open Source PostgreSQL \u003c17.1",
                  "product_id": "T039193"
                }
              },
              {
                "category": "product_version",
                "name": "17.1",
                "product": {
                  "name": "Open Source PostgreSQL 17.1",
                  "product_id": "T039193-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:postgresql:postgresql:17.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c16.5",
                "product": {
                  "name": "Open Source PostgreSQL \u003c16.5",
                  "product_id": "T039194"
                }
              },
              {
                "category": "product_version",
                "name": "16.5",
                "product": {
                  "name": "Open Source PostgreSQL 16.5",
                  "product_id": "T039194-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:postgresql:postgresql:16.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c15.9",
                "product": {
                  "name": "Open Source PostgreSQL \u003c15.9",
                  "product_id": "T039195"
                }
              },
              {
                "category": "product_version",
                "name": "15.9",
                "product": {
                  "name": "Open Source PostgreSQL 15.9",
                  "product_id": "T039195-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:postgresql:postgresql:15.9"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c14.14",
                "product": {
                  "name": "Open Source PostgreSQL \u003c14.14",
                  "product_id": "T039196"
                }
              },
              {
                "category": "product_version",
                "name": "14.14",
                "product": {
                  "name": "Open Source PostgreSQL 14.14",
                  "product_id": "T039196-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:postgresql:postgresql:14.14"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c13.17",
                "product": {
                  "name": "Open Source PostgreSQL \u003c13.17",
                  "product_id": "T039197"
                }
              },
              {
                "category": "product_version",
                "name": "13.17",
                "product": {
                  "name": "Open Source PostgreSQL 13.17",
                  "product_id": "T039197-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:postgresql:postgresql:13.17"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c12.21",
                "product": {
                  "name": "Open Source PostgreSQL \u003c12.21",
                  "product_id": "T039198"
                }
              },
              {
                "category": "product_version",
                "name": "12.21",
                "product": {
                  "name": "Open Source PostgreSQL 12.21",
                  "product_id": "T039198-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:postgresql:postgresql:12.21"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "PostgreSQL"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "T034267",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "SUSE openSUSE",
            "product": {
              "name": "SUSE openSUSE",
              "product_id": "T027843",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:opensuse:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-10976",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in PostgreSQL. Dieser Fehler existiert wegen der unvollst\u00e4ndigen Verfolgung von Tabellen mit Sicherheit auf Zeilenebene in der Abfrageplanungskomponente, was die Anwendung falscher Zeilensicherheitsrichtlinien erm\u00f6glicht. Ein entfernter, authentifizierter Angreifer kann diese Schwachstelle ausnutzen, um andere als die beabsichtigten Zeilen anzuzeigen oder zu \u00e4ndern, wodurch m\u00f6glicherweise rollenspezifische Richtlinien umgangen werden k\u00f6nnen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039197",
          "T039196",
          "T039198",
          "2951",
          "T002207",
          "T039193",
          "67646",
          "T000126",
          "T039195",
          "T039194",
          "T027843",
          "T034267"
        ]
      },
      "release_date": "2024-11-14T23:00:00.000+00:00",
      "title": "CVE-2024-10976"
    },
    {
      "cve": "CVE-2024-10977",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in PostgreSQL. Dieser Fehler existiert wegen der unsachgem\u00e4\u00dfen Behandlung von Server-Fehlermeldungen in der libpq-Clientkomponente, wodurch beliebige Nicht-NUL-Bytes verarbeitet werden k\u00f6nnen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, indem er manipulierte Fehlermeldungen sendet, die einen Benutzer oder ein automatisiertes Werkzeug dazu verleiten k\u00f6nnten, die Meldung als g\u00fcltige Abfrageergebnisse zu interpretieren. Zur erfolgreichen Ausnutzung ist eine Benutzerinteraktion erforderlich."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039197",
          "T039196",
          "T039198",
          "2951",
          "T002207",
          "T039193",
          "67646",
          "T000126",
          "T039195",
          "T039194",
          "T027843",
          "T034267"
        ]
      },
      "release_date": "2024-11-14T23:00:00.000+00:00",
      "title": "CVE-2024-10977"
    },
    {
      "cve": "CVE-2024-10978",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in PostgreSQL. Dieser Fehler existiert wegen einer fehlerhaften Rechtevergabe in der Rollenverwaltungskomponente, die einen nicht autorisierten Zugriff auf Daten erm\u00f6glicht. Ein entfernter, authentifizierter Angreifer kann diese Schwachstelle ausnutzen, indem er SET ROLE, SET SESSION AUTHORIZATION oder \u00e4hnliche Funktionen ausnutzt, um andere als die beabsichtigten Zeilen anzuzeigen oder zu \u00e4ndern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039197",
          "T039196",
          "T039198",
          "2951",
          "T002207",
          "T039193",
          "67646",
          "T000126",
          "T039195",
          "T039194",
          "T027843",
          "T034267"
        ]
      },
      "release_date": "2024-11-14T23:00:00.000+00:00",
      "title": "CVE-2024-10978"
    },
    {
      "cve": "CVE-2024-10979",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in PostgreSQL. Dieser Fehler existiert wegen einer inkorrekten Kontrolle von Umgebungsvariablen in der PL/Perl Komponente, die unautorisierte \u00c4nderungen an sensiblen Prozessumgebungsvariablen (z.B. PATH) erlaubt. Ein entfernter, authentifizierter Angreifer kann diese Schwachstelle ausnutzen, um die Ausf\u00fchrung von beliebigem Code zu erm\u00f6glichen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039197",
          "T039196",
          "T039198",
          "2951",
          "T002207",
          "T039193",
          "67646",
          "T000126",
          "T039195",
          "T039194",
          "T027843",
          "T034267"
        ]
      },
      "release_date": "2024-11-14T23:00:00.000+00:00",
      "title": "CVE-2024-10979"
    }
  ]
}