Clarification on CVE-2024-10979 and PostgreSQL Upgrade Necessity Without PL/Perl Usage

[Subhash Udata <subhashudata@xxxxxxxxx>]

Dear PostgreSQL Community,

I have a query related to the recent security vulnerability, CVE-2024-10979, concerning the PL/Perl extension.

From the advisory, it appears the vulnerability impacts systems utilizing the PL/Perl extension. My question is:

• If we do not use the PL/Perl extension in our PostgreSQL instance, is it still necessary to upgrade to the patched version of PostgreSQL? Or can we safely continue using our current version without concern?

We would like to understand whether this vulnerability has any implications for environments where the PL/Perl extension is not installed or used.

Thank you so much for your guidance on this.

Best regards,

Subhash Udata