A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- CVSS 3.0 Base Score: 3.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-server-develUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-plpython3 | May 4, 2022 | Jul 30, 2019 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql15Upgrade postgresql14 | Aug 22, 2024 | Jul 30, 2019 |
| Amazon_linux | — | Upgrade postgresql96Upgrade postgresql95 | Oct 28, 2020 | May 9, 2019 |
| Centos_linux | — | Upgrade postgresql-upgrade-debuginfoUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-pltcl-debuginfoUpgrade postgresqlUpgrade postgresql-server-develUpgrade postgresql-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-staticUpgrade postgresql-test-debuginfo | Sep 9, 2020 | Jul 30, 2019 |
| Debian | — | Upgrade postgresql-11 | May 10, 2019 | May 10, 2019 |
| Freebsd | — | Upgrade postgresql11-serverUpgrade postgresql96-serverUpgrade postgresql10-serverUpgrade postgresql95-server | May 11, 2019 | May 9, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jul 30, 2019 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-testUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresqlUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-plpython3Upgrade postgresql-contribUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgresql-pltcl | Sep 10, 2020 | May 9, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 10.8Upgrade to PostgreSQL version 9.6.13Upgrade to PostgreSQL version 9.5.17Upgrade to PostgreSQL version 11.3 | Jun 26, 2019 | Jun 26, 2019 |
| Redhat_linux | — | Upgrade postgresql-docsUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade postgresql-staticUpgrade postgresql-server-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-test-rpm-macrosUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-devel | Sep 9, 2020 | Jul 30, 2019 |
| Suse | — | Upgrade postgresql-plperlUpgrade postgresql12-contribUpgrade postgresql96-testUpgrade postgresql10-serverUpgrade postgresql12-docsUpgrade postgresql10Upgrade postgresqlUpgrade postgresql-testUpgrade libecpg6-32bitUpgrade postgresql96-serverUpgrade postgresql-docsUpgrade libpq5Upgrade postgresql-develUpgrade libpq5-32bitUpgrade postgresql-serverUpgrade postgresql12Upgrade postgresql12-serverUpgrade postgresql-llvmjitUpgrade postgresql96-plpythonUpgrade postgresql12-plperlUpgrade postgresql-pltclUpgrade postgresql-server-develUpgrade postgresql96-docsUpgrade postgresql-plpythonUpgrade postgresql96-pltclUpgrade postgresql10-plpythonUpgrade postgresql96-plperlUpgrade postgresql12-develUpgrade postgresql10-pltclUpgrade postgresql10-contribUpgrade postgresql12-testUpgrade postgresql10-docsUpgrade postgresql-contribUpgrade libecpg6Upgrade postgresql10-plperlUpgrade postgresql96-develUpgrade postgresql10-testUpgrade postgresql12-llvmjitUpgrade postgresql12-pltclUpgrade postgresql96-contribUpgrade postgresql96Upgrade postgresql10-develUpgrade postgresql12-server-develUpgrade postgresql12-plpython | Jun 15, 2019 | May 9, 2019 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-10Upgrade postgresql-11 | May 14, 2019 | May 9, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub