Search: CVE-2024-7348

A Time-of-check Time-of-use (TOCTOU) race condition vulnerability exists in the pg_dump utility of PostgreSQL. This flaw allows an object creator to execute arbitrary SQL functions with the privileges of the user running pg_dump, which is often a superuser. The attack involves replacing a relation type with a view or foreign table during the dump process. Versions prior to PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected. A patch is available to address this issue.