article Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump) in Official Support Articles

Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

Sebastian_Linser — Fri, 09 May 2025 10:55:01 GMT

Affected versions:

Qlik Sense Enterprise on Windows all versions, including November 2024

CVE-2024-7348 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in pg_dump, a utility used for backing up PostgreSQL databases. This vulnerability allows an attacker to replace a relation type (such as a table or sequence) with a view or foreign table right when pg_dump is running. Because pg_dump often runs with superuser privileges, this attack could execute arbitrary SQL code, leading to unauthorized actions or data corruption. Source: https://www.postgresql.org/support/security/CVE-2024-7348/

How does this vulnerability impact Qlik Sense Enterprise on Windows?

Qlik can confirm that pg_dump is not actively used in the Qlik Sense Enterprise on Windows code.

How to mitigate the vulnerability

Upgrade to Qlik Sense Enterprise on Windows May 2025 IR

Qlik Sense Enterprise on Windows May 2025 IR includes PostgreSQL 14.17 in its installer. See the System Requirements for details.

If upgrading Qlik Sense is not possible, manually upgrade PostgreSQL

Both steps are required to fully mitigate the issue.

Upgrade PostgreSQL. This requires a standalone instance of PostgreSQL. See Upgrading and unbundling the Qlik Sense Repository Database using the Qlik PostgreSQL Installer on how to unbundle PostgreSQL if necessary.
Always verify compatibility between your Qlik Sense version and PostgreSQL before planning an upgrade.
Delete the pg_dump.exe located in the default Qlik Sense Enterprise on Windows Postgresql install folder: C:\Program Files\Qlik\Sense\Repository\Postgresql\14\

The file will be recreated after an upgrade. This step will need to be repeated after each Qlik Sense upgrade. Qlik is actively investigating the removal of pg_dump from future installers (SHEND-2041).
The updated pg_dump.exe in, for example, C:\program files\postgresql\14 does not need to be removed.

Does the Qlik PostgreSQL Installer (QPI) use the pgdump.exe?

QPI does not utilise pgdump.exe.

Internal Investigation ID(s)

QB-28706
SHEND-2041

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

dennemanr — Wed, 11 Dec 2024 08:12:41 GMT

The link under Upgrading and unbundling the Qlik Sense Repository Database using the Qlik PostgreSQL Installer does not work.

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

Sonja_Bauernfeind — Wed, 11 Dec 2024 08:38:51 GMT

@dennemanr Fixed!

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

sis — Wed, 18 Dec 2024 07:11:58 GMT

@Sonja_Bauernfeind , @Sebastian_Linser

>The updated pg_dump.exe in, for example, C:\program files\postgresql\14 does not need to be removed.

Regarding the above, am I correct in my understanding that if a fixed version (14.13 or later) is manually installed, it does not need to be removed?

Also, if I have manually installed PostgresSQL, but I have a version prior to the fixed version, is it correct to recognize that you need to take action?

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

sis — Mon, 23 Dec 2024 02:36:20 GMT

@Sonja_Bauernfeind , @Sebastian_Linser

What is the status of the investigation regarding my question?
I'm sorry for your inconvenience, but thank you for your response.

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

Sonja_Bauernfeind — Mon, 23 Dec 2024 06:56:16 GMT

Hello @sis

Both steps are required. Your Standalone PostgreSQL instance will have the file stored (for example) here: C:\program files\postgresql\14

While the Qlik copy of the file is here: C:\Program Files\Qlik\Sense\Repository\Postgresql\14\ (this is the one which needs to be deleted as it will be version 14).

All the best,
Sonja

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

sis — Mon, 23 Dec 2024 07:43:12 GMT

@Sonja_Bauernfeind

Thanks for answering my question.

I understand that both steps are required after the PostgreSQL upgrade.
(I don't delete files stored by a standalone PostgreSQL instance.
I delete the following files:C:\Program Files\Qlik\Sense\Repository\Postgresql\14)

If I installed fixed version (14.13 or later) before installing Qlik Sense, it doesn't fall under this vulnerability, and therefore no action is required in that case?

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

Sonja_Bauernfeind — Mon, 23 Dec 2024 08:01:40 GMT

Hello @sis

I have forwarded this question. But please note that resources are currently not as readily available and a support case may be the easiest way to keep your question tracked.

All the best,
Sonja

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

Sonja_Bauernfeind — Mon, 23 Dec 2024 11:30:51 GMT

@sis To confirm:

The embedded binaries are always installed. Even if you have, from the start, chosen to use a standalone PostgreSQL instance.

All the best,
Sonja

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

sis — Tue, 24 Dec 2024 02:20:28 GMT

@Sonja_Bauernfeind

Thanks for the info.

＞Even if you have, from the start, chosen to use a standalone PostgreSQL instance.

In the above case, in the section 'How to mitigate vulnerabilities' in this article, is it sufficient to just delete the Postgresql installation folder (C:Program FilesQlikSenseRepositoryPostgresql14) without performing an upgrade?

I'm wondering if I can consider the upgrade to be already completed.

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

Sonja_Bauernfeind — Fri, 27 Dec 2024 07:59:44 GMT

Hello @sis

This is not a question I can answer myself. I will forward this one as well, but as before: resources are currently not as readily available so it may take time before we are able to get back to you.

All the best,
Sonja

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

Sonja_Bauernfeind — Fri, 27 Dec 2024 12:29:02 GMT

Hello @sis

Deleting the whole folder is not possible. Only delete the specific file which is not in use.

All the best,
Sonja

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

spalla — Fri, 27 Dec 2024 13:56:22 GMT

Hi,

What does - Qlik can confirm that pg_dump isnot actively used in the Qlik Sense Enterprise on Windows code mean?If the Qliksense is installed on windows no need to do anything?

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

Sonja_Bauernfeind — Fri, 27 Dec 2024 14:22:42 GMT

Hello @spalla

It means the file is not being used by Qlik Sense and can therefore be deleted without affecting the product itself.

To mitigate the PostgreSQL vulnerability, please follow the mentioned mitigation steps.

All the best,
Sonja Bauernfeind

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

spalla — Fri, 27 Dec 2024 14:29:40 GMT

Thank you.I get that file needs be deleted but what does it mean by below.

The updated pg_dump.exe in, for example, C:\program files\postgresql\14 does not need to be removed.

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

Sonja_Bauernfeind — Fri, 27 Dec 2024 14:44:32 GMT

@spalla Once you have unbundled and upgraded PostgreSQL to a version which includes the fix for the pgdump vulnerability, you will find two copies of pgdump.exe.

One will be in your Qlik Sense installation directory (example C:\Program Files\Qlik\Sense\Repository\Postgresql\x\) and will still be the same version as whatever was installed with Qlik Sense. These binaries are always installed with Qlik Sense. This is what you need to delete.

The second one will be in the location you pointed your standalone PostgreSQL install to (example: C:\program files\postgresql\x). The pgdump.exe in the second location will be whatever version you have just installed, meaning it is no longer vulnerable. You can still delete it, but do not have to.

If you choose to skip the unbundle and upgrade step, you will not have a file in the second location.

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

sis — Thu, 09 Jan 2025 09:23:57 GMT

@Sonja_Bauernfeind

If I upgrade Qlik Sense Enterprise on Windows after addressing this vulnerability, will the following folders be re-generated?

C:\Program Files\Qlik\Sense\Repository\Postgresql\14\

If the folder is regenerated, do I need to delete the "pg_dump.exe" every time I upgrade Qlik Sense Enterprise on Windows?

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

Sonja_Bauernfeind — Thu, 09 Jan 2025 12:59:28 GMT

Hello @sis

That is correct. I have updated the article accordingly and added our internal investigations for this topic so they an be easily referenced in future Release Notes.

All the best,
Sonja

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

Tool_Tip — Wed, 29 Jan 2025 05:17:54 GMT

We have already unbundled our postgres from 12 to 14 and changed the installation path to
C:\program files\postgresql\14.

So we do not have anything folder named as postgres inside default path "C:\Program Files\Qlik\Sense\Repository" so I think we do not need to take any action here as we are already running standalone postgres.

And to answer below question I would say that in our case after upgrading qliksense we didnt see that this folder is regenerated.

Re: Qlik Sense Enterprise on Windows and PostgreSQL vulnerability CVE-2024-7348 (pg_dump)

Tool_Tip — Wed, 29 Jan 2025 05:24:37 GMT

Can I conclude this as -

- Now onwards it is mandatory to use standalone postgres instead of bundled one ?

- By chance if anyone is getting "C:\Program Files\Qlik\Sense\Repository\Postgresql\14\" this folder is regenerating after any qliksense upgrade activity then it must be deleted due to "CVE-2024-7348" ?

Kindly confirm.