- Is this only an issue if they get postgres db user or superuser access?
- Is this because they could in essence create any PL/Python (or other PL/*) function script to run against the system? Example?
- Is there any way to mitigate this, other than not installing PL/*?
- The paragraph mentions other contrib modules. What other contrib modules could be a postgres/system security risk?
Note that if PL/Python, PL/Perl, etc are installed, or some contrib modules are present, then it might be fairly easy to escalate access from the postgres database user (or other superuser) to the postgres shell user. From there you can reconfigure the database to enable logging, install extensions, inject C code, etc. There is no guarantee you would detect such an exploit, so they might be logging activity for some time.