Particle.news
Get it on Google Play
Download on the App Store
3 ARTICLES
·
2h ago

PostgreSQL Fixes 12‑Year ‘PostGREShell’ Flaw That Let Replication Roles Run Arbitrary Code

The update adds an output_plugin_libraries whitelist that requires administrators to update servers and explicitly list any non-default output plugins to restore prior behavior.

Image
PostgreSQL Vulnerability

Overview

  • Cyera disclosed technical details on Sept. 1 showing a logical decoding bug present since 2014 that lets an account with the REPLICATION attribute name a library that the server then loads to run code and escalate to PostgreSQL superuser.
  • PostgreSQL published patches on Aug. 13 for supported branches (18.6, 17.11, 16.15, 15.19 and 14.24) that introduce the output_plugin_libraries setting and log failed loads when a plugin is not allowed.
  • After updating, administrators must run a query to find which output plugins are in use, add any non-default plugins such as wal2json or decoderbufs to output_plugin_libraries, and reload the configuration to restore logical decoding.
  • Short‑term mitigations include auditing and removing unneeded REPLICATION roles, restricting replication entries in pg_hba.conf to known hosts, blocking outbound SMB (port 445) and NFS (port 2049) from DB servers, and disabling autofs where possible.
  • An edge case with pg_createsubscriber and some distribution packaging details remain under review, and as of Sept. 4 there was no public proof‑of‑concept or CISA KEV listing, so operators should verify vendor advisories and confirm configuration changes after patching.