A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- CVSS 3.0 Base Score: 3.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-plperlUpgrade postgresql-plpython3Upgrade postgresql-testUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-contrib | May 4, 2022 | Jul 30, 2019 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresqlUpgrade postgresql15 | Aug 22, 2024 | Jul 30, 2019 |
| Amazon_linux | — | Upgrade postgresql96Upgrade postgresql95 | Oct 28, 2020 | May 9, 2019 |
| Centos_linux | — | Upgrade postgresql-plperlUpgrade postgresql-plpython3Upgrade postgresql-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-server-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-serverUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-pltclUpgrade postgresql-staticUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-contribUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-upgrade-devel-debuginfo | Sep 9, 2020 | Jul 30, 2019 |
| Debian | — | Upgrade postgresql-11 | May 10, 2019 | May 10, 2019 |
| Freebsd | — | Upgrade postgresql96-serverUpgrade postgresql11-serverUpgrade postgresql95-serverUpgrade postgresql10-server | May 11, 2019 | May 9, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jul 30, 2019 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresqlUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-upgradeUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-plpython3Upgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresqlUpgrade rh-postgresql10-postgresql-test | Sep 10, 2020 | May 9, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 9.6.13Upgrade to PostgreSQL version 10.8Upgrade to PostgreSQL version 9.5.17Upgrade to PostgreSQL version 11.3 | Jun 26, 2019 | Jun 26, 2019 |
| Redhat_linux | — | Upgrade postgresql-upgradeUpgrade postgresql-contribUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-staticUpgrade postgresql-debugsourceUpgrade postgresql-pltcl-debuginfoUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade postgresql-testUpgrade postgresql-server-debuginfoUpgrade postgresql-plperlUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-serverUpgrade postgresql-docs | Sep 9, 2020 | Jul 30, 2019 |
| Suse | — | Upgrade postgresql12-llvmjitUpgrade postgresql10-develUpgrade postgresql10-testUpgrade postgresql10-contribUpgrade postgresql96-develUpgrade postgresql-server-develUpgrade postgresql96-plpythonUpgrade postgresql12-plperlUpgrade postgresql12-develUpgrade postgresql96-contribUpgrade postgresql12-pltclUpgrade postgresql10-plperlUpgrade postgresql12-testUpgrade postgresql10-plpythonUpgrade postgresql10-pltclUpgrade libecpg6Upgrade postgresql-pltclUpgrade postgresql96-pltclUpgrade postgresql96-docsUpgrade postgresql96Upgrade postgresql-llvmjitUpgrade postgresql-contribUpgrade postgresql12-plpythonUpgrade postgresql96-plperlUpgrade postgresql10-docsUpgrade postgresql12-server-develUpgrade postgresql-plpythonUpgrade postgresql-docsUpgrade postgresql12-serverUpgrade libecpg6-32bitUpgrade postgresql10-serverUpgrade libpq5Upgrade postgresql12-contribUpgrade postgresql-develUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresqlUpgrade libpq5-32bitUpgrade postgresql-serverUpgrade postgresql10Upgrade postgresql96-testUpgrade postgresql12-docsUpgrade postgresql12Upgrade postgresql96-server | Jun 15, 2019 | May 9, 2019 |
| Ubuntu | — | Upgrade postgresql-11Upgrade postgresql-9.5Upgrade postgresql-10 | May 14, 2019 | May 9, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub