PT-2019-4078 · Postgresql+5 · Postgresql+5
Dean Rasheed
·
Publicado
2019-05-08
·
Atualizado
2026-01-30
·
CVE-2019-10130
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
PostgreSQL versions 9.5.x up to, excluding 9.5.17
PostgreSQL versions 9.6.x up to, excluding 9.6.13
PostgreSQL versions 10.x up to, excluding 10.8
PostgreSQL versions 11.x up to, excluding 11.3
Description
The issue is related to an error in the security policy of PostgreSQL, where column values with SELECT privilege can be read. This can allow a remote attacker to gain access to confidential data. The problem arises because PostgreSQL does not evaluate row security policies before consulting column statistics during query planning. As a result, an attacker can exploit this to read the most common values of certain columns, specifically those for which the attacker has SELECT privilege.
Recommendations
For PostgreSQL versions 9.5.x up to, excluding 9.5.17, update to version 9.5.17 or later to resolve the issue.
For PostgreSQL versions 9.6.x up to, excluding 9.6.13, update to version 9.6.13 or later to resolve the issue.
For PostgreSQL versions 10.x up to, excluding 10.8, update to version 10.8 or later to resolve the issue.
For PostgreSQL versions 11.x up to, excluding 11.3, update to version 11.3 or later to resolve the issue.
Correção
Improper Access Control
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Postgresql
Red Hat
Suse
Ubuntu