Red Hat Product Security issued an advisory (RHSA-2024:10791) for PostgreSQL vulnerabilities affecting Red Hat Enterprise Linux 9. The vulnerabilities include: CVE-2024-10978, where SET ROLE and SET SESSION AUTHORIZATION commands reset to the wrong user ID; CVE-2024-10979, where PL/Perl environment variable changes can lead to arbitrary code execution; and CVE-2024-10976, where PostgreSQL row security policies disregard user ID changes in subqueries. These issues could impact database security by allowing privilege mismanagement and code execution. The advisory provides updated PostgreSQL packages to address these vulnerabilities.

The vulnerabilities could allow unauthorized privilege escalation due to incorrect user ID resets, arbitrary code execution through PL/Perl environment variable manipulation, and bypassing of row security policies due to disregarded user ID changes in subqueries. This could compromise database integrity, confidentiality, and availability if exploited.

Red Hat has released updated PostgreSQL packages for Red Hat Enterprise Linux 9 to address these vulnerabilities. Users should apply these official updates promptly. For detailed update instructions, refer to Red Hat's advisory and article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided patches.