A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- CVSS 3.0 Base Score: 3.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-docs | May 4, 2022 | Jul 30, 2019 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql15Upgrade postgresql14 | Aug 22, 2024 | Jul 30, 2019 |
| Amazon_linux | — | Upgrade postgresql96Upgrade postgresql95 | Oct 28, 2020 | May 9, 2019 |
| Centos_linux | — | Upgrade postgresql-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-testUpgrade postgresql-server-debuginfoUpgrade postgresql-serverUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade postgresql-staticUpgrade postgresql-test-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-docsUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-pltclUpgrade postgresql-server-devel-debuginfo | Sep 9, 2020 | Jul 30, 2019 |
| Debian | — | Upgrade postgresql-11 | May 10, 2019 | May 10, 2019 |
| Freebsd | — | Upgrade postgresql95-serverUpgrade postgresql10-serverUpgrade postgresql11-serverUpgrade postgresql96-server | May 11, 2019 | May 9, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jul 30, 2019 |
| Oracle_linux | — | Upgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-staticUpgrade rh-postgresql10-postgresqlUpgrade postgresqlUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-test | Sep 10, 2020 | May 9, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 10.8Upgrade to PostgreSQL version 9.6.13Upgrade to PostgreSQL version 11.3Upgrade to PostgreSQL version 9.5.17 | Jun 26, 2019 | Jun 26, 2019 |
| Redhat_linux | — | Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-contribUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-develUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-docsUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-serverUpgrade postgresql-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-staticUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-pltcl-debuginfo | Sep 9, 2020 | Jul 30, 2019 |
| Suse | — | Upgrade postgresql10-plperlUpgrade postgresql12-server-develUpgrade postgresql10-develUpgrade postgresql10-pltclUpgrade postgresql96-contribUpgrade postgresql10-contribUpgrade postgresql-llvmjitUpgrade libecpg6Upgrade postgresql-server-develUpgrade postgresql10-docsUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql10-plpythonUpgrade postgresql-plpythonUpgrade postgresql10-testUpgrade postgresql12-llvmjitUpgrade postgresql12-pltclUpgrade postgresql96-plpythonUpgrade postgresql96-pltclUpgrade postgresql12-plpythonUpgrade postgresql12-testUpgrade postgresql96Upgrade postgresql96-plperlUpgrade postgresql12-develUpgrade postgresql96-docsUpgrade postgresql12-plperlUpgrade postgresql96-develUpgrade libpq5-32bitUpgrade libpq5Upgrade postgresql12-docsUpgrade postgresql96-testUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql10Upgrade postgresql96-serverUpgrade postgresql12Upgrade postgresql12-serverUpgrade postgresql12-contribUpgrade postgresql10-serverUpgrade postgresql-docsUpgrade libecpg6-32bitUpgrade postgresql-develUpgrade postgresql-plperlUpgrade postgresql | Jun 15, 2019 | May 9, 2019 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-11Upgrade postgresql-9.5 | May 14, 2019 | May 9, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub