Researchers Report RCE Vulnerabilities in PostgreSQL and MariaDB

Summary

Researchers uncovered critical RCE vulnerabilities in PostgreSQL and MariaDB, including 20-year-old heap buffer overflows in core extensions and JSON validation logic. The flaws allow authenticated users to escalate privileges and execute arbitrary OS commands, affecting a vast majority of cloud-hosted database environments.

Take Action:

Make sure your PostgreSQL and MariaDB databases are isolated from the internet and accessible only from trusted networks. Then update PostgreSQL to 18.2, 17.8, 16.12, 15.16, or 14.21 (and MariaDB to 11.4.10 or 11.8.6). Audit user permissions to remove any unnecessary CREATE or FILE privileges.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines