A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-contribUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-plpython3Upgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-devel | May 4, 2022 | Oct 29, 2019 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql14Upgrade postgresql15 | Nov 8, 2019 | Oct 29, 2019 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-devel | Jun 24, 2021 | Oct 29, 2019 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql94Upgrade postgresql96Upgrade postgresql92 | Oct 28, 2020 | Aug 8, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 29, 2019 |
| Centos_linux | — | Upgrade postgresql-upgrade-debuginfoUpgrade postgresql-docsUpgrade postgresql-debuginfoUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-debugsourceUpgrade postgresql-plpythonUpgrade postgresql-testUpgrade postgresql-test-debuginfoUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-staticUpgrade postgresql-pltclUpgrade postgresql-plperl-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-develUpgrade postgresql-upgradeUpgrade postgresql-contribUpgrade postgresql-plpython3Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contrib-debuginfo | Sep 9, 2020 | Oct 29, 2019 |
| Debian | — | Upgrade postgresql-11 | Aug 13, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade postgresql96-serverUpgrade postgresql10-serverUpgrade postgresql95-serverUpgrade postgresql11-serverUpgrade postgresql94-server | Aug 9, 2019 | Aug 8, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-test | Sep 30, 2019 | Aug 8, 2019 |
| Oracle_linux | — | Upgrade postgresql-testUpgrade postgresqlUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade rh-postgresql10-postgresql-testUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-libsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-plpython3 | Sep 10, 2020 | Aug 8, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 11.5 | Aug 9, 2019 | Aug 9, 2019 |
| Redhat_linux | — | Upgrade postgresql-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-serverUpgrade postgresql-debuginfoUpgrade postgresqlUpgrade postgresql-server-debuginfoUpgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-plpython3-debuginfoNo solution existsUpgrade postgresql-server-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-libsUpgrade postgresql-contribUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltclUpgrade postgresql-develUpgrade postgresql-upgradeUpgrade postgresql-test-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-docs-debuginfo | Sep 9, 2020 | Oct 29, 2019 |
| Suse | — | Upgrade postgresql-docsUpgrade libpq5-32bitUpgrade postgresql96-testUpgrade postgresql12-plpythonUpgrade postgresql96-plpythonUpgrade postgresql12-contribUpgrade postgresql94-contribUpgrade postgresql12-serverUpgrade postgresql96-plperlUpgrade postgresql96-serverUpgrade postgresql12-server-develUpgrade postgresql94-docsUpgrade postgresql10Upgrade libecpg6-32bitUpgrade postgresql-testUpgrade postgresql12-testUpgrade postgresql94-pltclUpgrade postgresql10-plperlUpgrade postgresql-develUpgrade postgresql12-docsUpgrade postgresql12-pltclUpgrade postgresqlUpgrade postgresql10-serverUpgrade postgresql-serverUpgrade libpq5Upgrade postgresql12-develUpgrade postgresql94-plperlUpgrade postgresql-llvmjitUpgrade postgresql10-plpythonUpgrade postgresql10-develUpgrade postgresql-plpythonUpgrade postgresql96Upgrade postgresql12Upgrade postgresql10-contribUpgrade postgresql-plperlUpgrade postgresql12-llvmjitUpgrade postgresql94Upgrade postgresql-pltclUpgrade libecpg6Upgrade postgresql-contribUpgrade postgresql96-pltclUpgrade postgresql-server-develUpgrade postgresql96-docsUpgrade postgresql12-plperlUpgrade postgresql10-pltclUpgrade postgresql94-serverUpgrade postgresql96-develUpgrade postgresql10-docsUpgrade postgresql94-plpythonUpgrade postgresql10-testUpgrade postgresql96-contrib | Aug 22, 2019 | Aug 8, 2019 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-11Upgrade postgresql-10 | Aug 10, 2019 | Aug 8, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub