A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any user can create a partitioned table suitable for this attack. (Exploit prerequisites are the same as for CVE-2018-1052).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresqlUpgrade postgresql15 | Aug 22, 2024 | Jul 30, 2019 |
| Freebsd | — | Upgrade postgresql11-server | May 11, 2019 | May 9, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jul 30, 2019 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-plperl | Jun 12, 2021 | May 9, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 11.3 | May 10, 2019 | May 10, 2019 |
| Ubuntu | — | Upgrade postgresql-11Upgrade postgresql-9.5Upgrade postgresql-10 | May 14, 2019 | May 9, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub