Postgres Pro
Downloads
Home   >   mailing lists

Thread: CVE-2024-10979 - Does this affect Postgres built without --with-perl option?

CVE-2024-10979 - Does this affect Postgres built without --with-perl option?

From
Mark Hill
Date:

Does the CVE-2024-10979 affect Postgres that is NOT built with the --with-perl  option?

Thanks, Mark

Re: CVE-2024-10979 - Does this affect Postgres built without --with-perl option?

From
"David G. Johnston"
Date:
On Wed, Dec 4, 2024 at 10:07 AM Mark Hill <Mark.Hill@sas.com> wrote:

Does the CVE-2024-10979 affect Postgres that is NOT built with the --with-perl  option?


It requires the attacker being able to write and get executed a PL function in the server written in pl/perl.  That is impossible if the server hasn't been compiled using the --with-perl option.

David J.