A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- CVSS 3.0 Base Score: 3.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresqlUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-plpython3Upgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-docs | May 4, 2022 | Jul 30, 2019 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresql | Aug 22, 2024 | Jul 30, 2019 |
| Amazon_linux | — | Upgrade postgresql96Upgrade postgresql95 | Oct 28, 2020 | May 9, 2019 |
| Centos_linux | — | Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgradeUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-serverUpgrade postgresql-debugsourceUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debuginfoUpgrade postgresqlUpgrade postgresql-server-debuginfoUpgrade postgresql-test | Sep 9, 2020 | Jul 30, 2019 |
| Debian | — | Upgrade postgresql-11 | May 10, 2019 | May 10, 2019 |
| Freebsd | — | Upgrade postgresql95-serverUpgrade postgresql10-serverUpgrade postgresql11-serverUpgrade postgresql96-server | May 11, 2019 | May 9, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jul 30, 2019 |
| Oracle_linux | — | Upgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-docsUpgrade postgresqlUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-testUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-serverUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-plpython3Upgrade postgresql-docsUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-contrib | Sep 10, 2020 | May 9, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 9.5.17Upgrade to PostgreSQL version 11.3Upgrade to PostgreSQL version 10.8Upgrade to PostgreSQL version 9.6.13 | Jun 26, 2019 | Jun 26, 2019 |
| Redhat_linux | — | Upgrade postgresql-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade postgresql-pltclUpgrade postgresql-server-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-staticUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-server-develUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade | Sep 9, 2020 | Jul 30, 2019 |
| Suse | — | Upgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresqlUpgrade libpq5-32bitUpgrade postgresql10-serverUpgrade postgresql96-serverUpgrade libecpg6-32bitUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql12-serverUpgrade postgresql96-testUpgrade postgresql12-docsUpgrade libpq5Upgrade postgresql-serverUpgrade postgresql12-contribUpgrade postgresql10Upgrade postgresql12Upgrade postgresql96-plpythonUpgrade postgresql10-pltclUpgrade postgresql-contribUpgrade postgresql12-testUpgrade postgresql96Upgrade postgresql-pltclUpgrade libecpg6Upgrade postgresql12-pltclUpgrade postgresql96-contribUpgrade postgresql10-plperlUpgrade postgresql10-docsUpgrade postgresql10-contribUpgrade postgresql-server-develUpgrade postgresql10-testUpgrade postgresql10-develUpgrade postgresql12-plperlUpgrade postgresql12-llvmjitUpgrade postgresql96-develUpgrade postgresql96-docsUpgrade postgresql96-plperlUpgrade postgresql-llvmjitUpgrade postgresql12-server-develUpgrade postgresql96-pltclUpgrade postgresql12-develUpgrade postgresql12-plpythonUpgrade postgresql-plpythonUpgrade postgresql10-plpython | Jun 15, 2019 | May 9, 2019 |
| Ubuntu | — | Upgrade postgresql-11Upgrade postgresql-9.5Upgrade postgresql-10 | May 14, 2019 | May 9, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub