PT-2019-2540 · Postgresql+5 · Postgresql+5

Alexander Lakhin · Published 2019-06-19 · Updated 2024-06-15 · CVE-2019-10164

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 10.x through 10.8 PostgreSQL versions 11.x through 11.3

Description The issue is caused by a stack-based buffer overflow in the PostgreSQL database management system. This can be exploited by an authenticated user changing their own password to a specially crafted value, potentially allowing the execution of arbitrary code as the PostgreSQL operating system account.

Recommendations For PostgreSQL versions 10.x through 10.8, update to version 10.9 or later. For PostgreSQL versions 11.x through 11.3, update to version 11.4 or later. As a temporary workaround, consider restricting password changes for users until a patch is applied.

Fix

Stack Overflow

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-119

CWE-787

Related Identifiers

ALT-PU-2019-2103

ALT-PU-2019-2104

ALT-PU-2019-2105

ALT-PU-2019-2127

ALT-PU-2019-2128

ALT-PU-2019-2129

BDU:2019-02385

CESA-2020_3669

CVE-2019-10164

MGASA-2019-0204

OPENSUSE-SU-2019:1773-1

OPENSUSE-SU-2019_1773-1

OPENSUSE-SU-2024:11184-1

OPENSUSE-SU-2024:11185-1

RHSA-2020:0980

RHSA-2020:3669

RHSA-2020:5664

RHSA-2020_3669

RHSA-2021:0166

SUSE-RU-2020:1280-1

SUSE-SU-2019:1783-1

SUSE-SU-2019:1783-2

SUSE-SU-2019:1783-3

SUSE-SU-2019:1810-1

SUSE-SU-2019:2012-1

SUSE-SU-2019_1783-1

SUSE-SU-2019_1783-2

USN-4027-1

Affected Products

Alt Linux

Centos

Postgresql

Red Hat

Suse

Ubuntu

References · 75

• https://osv.dev/vulnerability/SUSE-SU-2019:1783-3 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0204.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-10164 · Security Note
• https://osv.dev/vulnerability/SUSE-RU-2020:1280-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202003-03 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-10164 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02385 · Security Note
• https://postgresql.org/about/news/1949 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4027-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4027-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00035.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10164 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAGE6H4FWLKFLHLWVYNPYGQRPIXTUWGB · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11185-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:1783-1 · Vendor Advisory