PT-2019-2942 · Postgresql+1 · Postgresql+1

Daniel Gustafsson · Publicado 2019-05-08 · Atualizado 2021-10-28 · CVE-2019-10211

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Postgresql versions prior to 11.5 Postgresql versions prior to 10.10 Postgresql versions prior to 9.6.15 Postgresql versions prior to 9.5.19 Postgresql versions prior to 9.4.24

Description The issue is related to the Postgresql Windows installer, which is vulnerable due to the bundled OpenSSL executing code from an unprotected directory. This vulnerability is associated with errors in code generation management, which can be exploited to impact the confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 11.5, update to version 11.5 or later. For versions prior to 10.10, update to version 10.10 or later. For versions prior to 9.6.15, update to version 9.6.15 or later. For versions prior to 9.5.19, update to version 9.5.19 or later. For versions prior to 9.4.24, update to version 9.4.24 or later.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2019-02917

CVE-2019-10211

Produtos afetados

Openssl

Postgresql

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2019-10211 · Nota de Segurança
• https://access.redhat.com/security/cve/cve-2019-10211 · Nota
• https://postgresql.org/about/news/1960 · Aviso do Fabricante
• https://postgresql.org/support/security/CVE-2019-10211 · Nota
• https://pangolin.sbertech.ru/cve-policy?cve=CVE-2019-10211 · Nota
• https://bdu.fstec.ru/vul/2019-02917 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-10211 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10211 · Nota