PT-2019-4078 · Postgresql+5 · Postgresql+5
Dean Rasheed
·
Published
2019-05-08
·
Updated
2026-01-30
·
CVE-2019-10130
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
PostgreSQL versions 9.5.x up to, excluding 9.5.17
PostgreSQL versions 9.6.x up to, excluding 9.6.13
PostgreSQL versions 10.x up to, excluding 10.8
PostgreSQL versions 11.x up to, excluding 11.3
Description
The issue is related to an error in the security policy of PostgreSQL, where column values with SELECT privilege can be read. This can allow a remote attacker to gain access to confidential data. The problem arises because PostgreSQL does not evaluate row security policies before consulting column statistics during query planning. As a result, an attacker can exploit this to read the most common values of certain columns, specifically those for which the attacker has SELECT privilege.
Recommendations
For PostgreSQL versions 9.5.x up to, excluding 9.5.17, update to version 9.5.17 or later to resolve the issue.
For PostgreSQL versions 9.6.x up to, excluding 9.6.13, update to version 9.6.13 or later to resolve the issue.
For PostgreSQL versions 10.x up to, excluding 10.8, update to version 10.8 or later to resolve the issue.
For PostgreSQL versions 11.x up to, excluding 11.3, update to version 11.3 or later to resolve the issue.
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Postgresql
Red Hat
Suse
Ubuntu