PostgreSQL up to 16.3 pg_dump toctou

Summaryinfo

A vulnerability, which was classified as very critical, has been found in PostgreSQL up to 12.19/13.15/14.12/15.7/16.3. This issue affects the function pg_dump. Performing a manipulation results in toctou. This vulnerability is identified as CVE-2024-7348. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, was found in PostgreSQL up to 12.19/13.15/14.12/15.7/16.3. This affects the function pg_dump. The manipulation with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.

The advisory is shared at postgresql.org. This vulnerability is uniquely identified as CVE-2024-7348 since 07/31/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/27/2025).

The vulnerability scanner Nessus provides a plugin with the ID 208064 (SUSE SLES15 Security Update : postgresql16 (SUSE-SU-2024:3158-3)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 12.20, 13.16, 14.13, 15.8 or 16.4 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (208064) and CERT Bund (WID-SEC-2025-2329). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• cPanel cPanel/WHM

Productinfo

Type

• Database Software

Name

• PostgreSQL

Version

• 12.0
• 12.1
• 12.2
• 12.3
• 12.4
• 12.5
• 12.6
• 12.7
• 12.8
• 12.9
• 12.10
• 12.11
• 12.12
• 12.13
• 12.14
• 12.15
• 12.16
• 12.17
• 12.18
• 12.19
• 13.0
• 13.1
• 13.2
• 13.3
• 13.4
• 13.5
• 13.6
• 13.7
• 13.8
• 13.9
• 13.10
• 13.11
• 13.12
• 13.13
• 13.14
• 13.15
• 14.0
• 14.1
• 14.2
• 14.3
• 14.4
• 14.5
• 14.6
• 14.7
• 14.8
• 14.9
• 14.10
• 14.11
• 14.12
• 15.0
• 15.1
• 15.2
• 15.3
• 15.4
• 15.5
• 15.6
• 15.7
• 16.0
• 16.1
• 16.2
• 16.3

License

• open-source

Website

• Product: https://www.postgresql.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion