Total vulnerabilities in the database
Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
| Software | From | Fixed in |
|---|---|---|
| postgresql / postgresql | 17.0 | 17.1 |
| postgresql / postgresql | 16.0 | 16.5 |
| postgresql / postgresql | 15.0 | 15.9 |
| postgresql / postgresql | 14.0 | 14.14 |
| postgresql / postgresql | 13.0 | 13.17 |
| postgresql / postgresql | 12.0 | 12.21 |