PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql14Upgrade postgresql | Jul 5, 2019 | Jun 26, 2019 |
| Centos_linux | — | Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-docsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresqlUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresql-debugsourceUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-contribUpgrade postgresql-server-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-docs-debuginfoUpgrade postgresql-serverUpgrade postgresql-debuginfoUpgrade postgresql-plpython3 | Sep 9, 2020 | Jun 26, 2019 |
| Freebsd | — | Upgrade postgresql11-serverUpgrade postgresql10-server | Jun 27, 2019 | Jun 27, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jun 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-plperl | Aug 28, 2019 | Jun 26, 2019 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-testUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-contribUpgrade postgresql-plpython3Upgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-upgradeUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresqlUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-upgrade-develUpgrade postgresql-static | Sep 10, 2020 | Jun 20, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 11.4 | Jun 21, 2019 | Jun 21, 2019 |
| Redhat_linux | — | Upgrade postgresql-upgradeUpgrade postgresql-pltclUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-testUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-debuginfoUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-upgrade-devel-debuginfo | Sep 9, 2020 | Jun 26, 2019 |
| Suse | — | Upgrade libpq5-32bitUpgrade postgresql12-serverUpgrade postgresql10-plperlUpgrade postgresql12-pltclUpgrade postgresqlUpgrade postgresql10-serverUpgrade postgresql12-server-develUpgrade libecpg6-32bitUpgrade postgresql12-docsUpgrade postgresql12-contribUpgrade postgresql-docsUpgrade postgresql12-plpythonUpgrade postgresql10-testUpgrade postgresql12-develUpgrade python3-psycopg2Upgrade postgresql-plperlUpgrade postgresql-develUpgrade libpq5Upgrade postgresql10-pltclUpgrade libecpg6Upgrade postgresql10Upgrade postgresql12Upgrade postgresql12-plperlUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql10-plpythonUpgrade postgresql10-contribUpgrade postgresql10-docsUpgrade postgresql-plpythonUpgrade postgresql10-devel | Jul 10, 2019 | Jun 20, 2019 |
| Ubuntu | — | Upgrade postgresql-11Upgrade postgresql-10 | Jun 21, 2019 | Jun 20, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub