A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- CVSS 3.0 Base Score: 3.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-plpython3Upgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-testUpgrade postgresql-test-rpm-macrosUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-server-develUpgrade postgresql-contrib | May 4, 2022 | Jul 30, 2019 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresqlUpgrade postgresql14 | Aug 22, 2024 | Jul 30, 2019 |
| Amazon_linux | — | Upgrade postgresql96Upgrade postgresql95 | Oct 28, 2020 | May 9, 2019 |
| Centos_linux | — | Upgrade postgresql-server-develUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-serverUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-server-debuginfoUpgrade postgresql-plperlUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contrib-debuginfoUpgrade postgresql-staticUpgrade postgresql-upgrade-devel-debuginfo | Sep 9, 2020 | Jul 30, 2019 |
| Debian | — | Upgrade postgresql-11 | May 10, 2019 | May 10, 2019 |
| Freebsd | — | Upgrade postgresql11-serverUpgrade postgresql96-serverUpgrade postgresql95-serverUpgrade postgresql10-server | May 11, 2019 | May 9, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jul 30, 2019 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-docsUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-testUpgrade postgresqlUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql-testUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-docsUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-plpython3Upgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-libs | Sep 10, 2020 | May 9, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 9.6.13Upgrade to PostgreSQL version 10.8Upgrade to PostgreSQL version 9.5.17Upgrade to PostgreSQL version 11.3 | Jun 26, 2019 | Jun 26, 2019 |
| Redhat_linux | — | Upgrade postgresql-upgrade-develUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-server-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-contribUpgrade postgresql-testUpgrade postgresql-debugsourceUpgrade postgresql-serverUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-debuginfoUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-staticUpgrade postgresql-plperlUpgrade postgresql-pltcl-debuginfo | Sep 9, 2020 | Jul 30, 2019 |
| Suse | — | Upgrade postgresql10-plperlUpgrade postgresql10-pltclUpgrade libecpg6Upgrade postgresql10-plpythonUpgrade postgresql12-testUpgrade postgresql10-docsUpgrade postgresql-plpythonUpgrade postgresql96-contribUpgrade postgresql-pltclUpgrade postgresql12-llvmjitUpgrade postgresql-server-develUpgrade postgresql96-pltclUpgrade postgresql12-pltclUpgrade postgresql10-develUpgrade postgresql10-testUpgrade postgresql12-server-develUpgrade postgresql96Upgrade postgresql-llvmjitUpgrade postgresql96-develUpgrade postgresql96-docsUpgrade postgresql12-plperlUpgrade postgresql96-plperlUpgrade postgresql12-develUpgrade postgresql-contribUpgrade postgresql12-plpythonUpgrade postgresql96-plpythonUpgrade postgresql10-contribUpgrade postgresql-serverUpgrade postgresql-docsUpgrade libpq5Upgrade libecpg6-32bitUpgrade postgresql-develUpgrade postgresql10Upgrade postgresql-testUpgrade postgresqlUpgrade postgresql96-serverUpgrade libpq5-32bitUpgrade postgresql12Upgrade postgresql96-testUpgrade postgresql12-docsUpgrade postgresql12-serverUpgrade postgresql10-serverUpgrade postgresql12-contribUpgrade postgresql-plperl | Jun 15, 2019 | May 9, 2019 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-11Upgrade postgresql-10 | May 14, 2019 | May 9, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub