Is CVE-2024-7348 in the CISA KEV catalog?

No. CVE-2024-7348 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2024-7348?

CVE-2024-7348 has a CVSS v3 base score of 8.8 (HIGH).

What is the EPSS score for CVE-2024-7348?

CVE-2024-7348 has an EPSS score of 1.57% (72th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2024-7348?

Upgrade postgresql-13 on debian 11 to 13.16-0+deb11u1 or later. Fixes are available for 93 affected products.

CVE & CISA-KEV Catalog

CVE-2024-7348

HIGHEPSS 72th pctl

8.8

CVSS v3

NVD

Description

Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.

CWE-367TOCTOU Race Condition

How to fix

Remediation Available

postgresql-13Debian

Fixed in:13.16-0+deb11u1CVE-2024-7348

pg_repackRed Hat / RHEL

Fixed in:0:1.4.8-1.module+el8.10.0+20413+d8116364.src::postgresql:16RHSA-2024:5927

Fixed in:0:1.4.8-1.module+el8.9.0+19797+c4ce5969.src::postgresql:15RHSA-2024:6001

Fixed in:0:1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64::postgresql:12RHSA-2024:6559

Fixed in:0:1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64::postgresql:15RHSA-2024:6142

Fixed in:0:1.4.8-1.module+el8.10.0+20413+d8116364.aarch64::postgresql:16RHSA-2024:5927

Fixed in:0:1.4.6-3.module+el8.5.0+11354+78b3c9c5.src::postgresql:12RHSA-2024:6559

Fixed in:0:1.4.6-3.module+el8.5.0+11354+78b3c9c5.src::postgresql:12RHSA-2024:6137

Fixed in:0:1.4.8-1.module+el8.9.0+19797+c4ce5969.s390x::postgresql:15RHSA-2024:6001

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13RHSA-2024:6558

Fixed in:0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.src::postgresql:15RHSA-2024:6140

Fixed in:0:1.4.8-1.module+el9.4.0+20427+07482b8c.aarch64::postgresql:16RHSA-2024:5929

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13RHSA-2024:6141

Fixed in:0:1.4.8-1.module+el8.8.0+17071+aaaceaa4.s390x::postgresql:15RHSA-2024:6142

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13RHSA-2024:6141

Fixed in:0:1.4.6-3.module+el8.9.0+19330+c97ddbdf.src::postgresql:12RHSA-2024:6000

Fixed in:0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15RHSA-2024:6020

Fixed in:0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15RHSA-2024:6020

Fixed in:0:1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64::postgresql:12RHSA-2024:6137

Fixed in:0:1.4.6-3.module+el8.9.0+19330+c97ddbdf.x86_64::postgresql:12RHSA-2024:6000

Fixed in:0:1.4.8-1.module+el8.9.0+19797+c4ce5969.ppc64le::postgresql:15RHSA-2024:6001

Fixed in:0:1.4.6-3.module+el8.9.0+19330+c97ddbdf.ppc64le::postgresql:12RHSA-2024:6000

Fixed in:0:1.4.8-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15RHSA-2024:6142

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13RHSA-2024:6141

Fixed in:0:1.4.6-3.module+el8.9.0+20664+9c30cf7f.ppc64le::postgresql:13RHSA-2024:6018

Fixed in:0:1.4.8-1.module+el9.4.0+20427+07482b8c.s390x::postgresql:16RHSA-2024:5929

Fixed in:0:1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le::postgresql:12RHSA-2024:6559

Fixed in:0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.x86_64::postgresql:15RHSA-2024:6140

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13RHSA-2024:6558

Fixed in:0:1.4.8-1.module+el8.8.0+17071+aaaceaa4.ppc64le::postgresql:15RHSA-2024:6142

Fixed in:0:1.4.8-1.module+el9.4.0+20427+07482b8c.ppc64le::postgresql:16RHSA-2024:5929

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13RHSA-2024:6558

Fixed in:0:1.4.8-1.module+el8.10.0+20413+d8116364.ppc64le::postgresql:16RHSA-2024:5927

Fixed in:0:1.4.8-1.module+el8.10.0+20413+d8116364.x86_64::postgresql:16RHSA-2024:5927

Fixed in:0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15RHSA-2024:6140

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13RHSA-2024:6141

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13RHSA-2024:6558

Fixed in:0:1.4.8-1.module+el8.9.0+19797+c4ce5969.x86_64::postgresql:15RHSA-2024:6001

Fixed in:0:1.4.6-3.module+el8.5.0+11354+78b3c9c5.s390x::postgresql:12RHSA-2024:6137

Fixed in:0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15RHSA-2024:6020

Fixed in:0:1.4.6-3.module+el8.9.0+20664+9c30cf7f.s390x::postgresql:13RHSA-2024:6018

Fixed in:0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15RHSA-2024:6140

Fixed in:0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15RHSA-2024:6140

Fixed in:0:1.4.6-3.module+el8.9.0+20664+9c30cf7f.x86_64::postgresql:13RHSA-2024:6018

Fixed in:0:1.4.8-1.module+el8.8.0+17071+aaaceaa4.aarch64::postgresql:15RHSA-2024:6142

Fixed in:0:1.4.6-3.module+el8.5.0+11354+78b3c9c5.s390x::postgresql:12RHSA-2024:6559

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13RHSA-2024:6141

Fixed in:0:1.4.6-3.module+el8.5.0+11354+78b3c9c5.aarch64::postgresql:12RHSA-2024:6137

Fixed in:0:1.4.6-3.module+el8.9.0+19330+c97ddbdf.aarch64::postgresql:12RHSA-2024:6000

Fixed in:0:1.4.8-1.module+el8.10.0+20413+d8116364.s390x::postgresql:16RHSA-2024:5927

Fixed in:0:1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le::postgresql:12RHSA-2024:6137

Fixed in:0:1.4.6-3.module+el8.5.0+11354+78b3c9c5.aarch64::postgresql:12RHSA-2024:6559

Fixed in:0:1.4.8-1.module+el9.4.0+20427+07482b8c.src::postgresql:16RHSA-2024:5929

Fixed in:0:1.4.8-1.module+el9.4.0+20427+07482b8c.x86_64::postgresql:16RHSA-2024:5929

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13RHSA-2024:6558

Fixed in:0:1.4.6-3.module+el8.9.0+19330+c97ddbdf.s390x::postgresql:12RHSA-2024:6000

Fixed in:0:1.4.6-3.module+el8.9.0+20664+9c30cf7f.src::postgresql:13RHSA-2024:6018

Fixed in:0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.x86_64::postgresql:15RHSA-2024:6020

Fixed in:0:1.4.6-3.module+el8.9.0+20664+9c30cf7f.aarch64::postgresql:13RHSA-2024:6018

Fixed in:0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.src::postgresql:15RHSA-2024:6020

Fixed in:0:1.4.8-1.module+el8.9.0+19797+c4ce5969.aarch64::postgresql:15RHSA-2024:6001

pg_repackRocky