CVE-2024-2339

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-2339

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2339.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-2339

Published

2024-03-08T20:07:14.838Z

Modified

2026-07-15T01:49:12.364404815Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Improper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule

Details

PostgreSQL Anonymizer v1.2 contains a vulnerability that allows a user who owns a table to elevate to superuser. A user can define a masking function for a column and place malicious code in that function. When a privileged user applies the masking rules using the static masking or the anonymous dump method, the malicious code is executed and can grant escalated privileges to the malicious user. PostgreSQL Anonymizer v1.2 does provide a protection against this risk with the restricttotrusted_schemas option, but that protection is incomplete. Users that don't own a table, especially masked users cannot exploit this vulnerability. The problem is resolved in v1.3.

Database specific

{
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2339.json",
    "cna_assigner": "PostgreSQL"
}

References

Affected packages

Git / gitlab.com/dalibo/postgresql_anonymizer

Affected ranges

Type

GIT

Repo

https://gitlab.com/dalibo/postgresql_anonymizer

Events

Introduced

c79d5b610629a197f1eb4c868168c8cba9db4868

Fixed

fb2d88317066814540dceecee35ee223baa7fec3

Database specific

{
    "extracted_events": [
        {
            "introduced": "1"
        },
        {
            "fixed": "1.3.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.2.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2339.json"