PT-2019-3231 · Postgresql+5 · Postgresql+5
Tom Lane
·
Published
2019-08-07
·
Updated
2026-01-30
·
CVE-2019-10208
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
postgresql versions 9.4.x before 9.4.24
postgresql versions 9.5.x before 9.5.19
postgresql versions 9.6.x before 9.6.15
postgresql versions 10.x before 10.10
postgresql versions 11.x before 11.5
Description
A flaw in postgresql allows arbitrary SQL statements to be executed given a suitable SECURITY DEFINER function. An attacker with EXECUTE permission on the function can execute arbitrary SQL as the owner of the function. The vulnerability is related to the lack of protection of the SQL query structure in the SECURITY DEFINER function of the PostgreSQL database management system. Exploitation of the vulnerability can allow a remote attacker to execute arbitrary SQL commands.
Recommendations
For postgresql versions 9.4.x before 9.4.24, update to version 9.4.24 or later.
For postgresql versions 9.5.x before 9.5.19, update to version 9.5.19 or later.
For postgresql versions 9.6.x before 9.6.15, update to version 9.6.15 or later.
For postgresql versions 10.x before 10.10, update to version 10.10 or later.
For postgresql versions 11.x before 11.5, update to version 11.5 or later.
As a temporary workaround, consider restricting EXECUTE permission on SECURITY DEFINER functions to minimize the risk of exploitation.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Postgresql
Red Hat
Suse
Ubuntu