A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any user can create a partitioned table suitable for this attack. (Exploit prerequisites are the same as for CVE-2018-1052).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql14Upgrade postgresql | Aug 22, 2024 | Jul 30, 2019 |
| Freebsd | — | Upgrade postgresql11-server | May 11, 2019 | May 9, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jul 30, 2019 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-contrib | Jun 12, 2021 | May 9, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 11.3 | May 10, 2019 | May 10, 2019 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-11Upgrade postgresql-9.5 | May 14, 2019 | May 9, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub