A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- CVSS 3.0 Base Score: 3.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-plpython3Upgrade postgresql-docsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade postgresql-static | May 4, 2022 | Jul 30, 2019 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql15Upgrade postgresql14 | Aug 22, 2024 | Jul 30, 2019 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql96 | Oct 28, 2020 | May 9, 2019 |
| Centos_linux | — | Upgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-docsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-staticUpgrade postgresql-contrib-debuginfoUpgrade postgresql-pltclUpgrade postgresql-test-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-pltcl-debuginfoUpgrade postgresql-server-develUpgrade postgresql-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperlUpgrade postgresql-upgrade | Sep 9, 2020 | Jul 30, 2019 |
| Debian | — | Upgrade postgresql-11 | May 10, 2019 | May 10, 2019 |
| Freebsd | — | Upgrade postgresql10-serverUpgrade postgresql95-serverUpgrade postgresql11-serverUpgrade postgresql96-server | May 11, 2019 | May 9, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jul 30, 2019 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresqlUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-testUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-test | Sep 10, 2020 | May 9, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 9.5.17Upgrade to PostgreSQL version 11.3Upgrade to PostgreSQL version 10.8Upgrade to PostgreSQL version 9.6.13 | Jun 26, 2019 | Jun 26, 2019 |
| Redhat_linux | — | Upgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade postgresql-docs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-contribUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltclUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresqlUpgrade postgresql-server-debuginfoUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-test-rpm-macrosUpgrade postgresql-static | Sep 9, 2020 | Jul 30, 2019 |
| Suse | — | Upgrade postgresql96-pltclUpgrade postgresql96-plperlUpgrade postgresql10-plpythonUpgrade postgresql12-pltclUpgrade postgresql-pltclUpgrade postgresql96-develUpgrade postgresql10-testUpgrade postgresql12-llvmjitUpgrade postgresql-server-develUpgrade postgresql10-develUpgrade postgresql10-docsUpgrade postgresql96-plpythonUpgrade postgresql96-contribUpgrade postgresql10-plperlUpgrade postgresql-contribUpgrade postgresql12-plperlUpgrade postgresql12-testUpgrade postgresql12-plpythonUpgrade postgresql-llvmjitUpgrade postgresql10-pltclUpgrade libecpg6Upgrade postgresql12-develUpgrade postgresql10-contribUpgrade postgresql96-docsUpgrade postgresql12-server-develUpgrade postgresql96Upgrade postgresql-plpythonUpgrade postgresql10-serverUpgrade libpq5Upgrade postgresql-plperlUpgrade postgresql12-contribUpgrade postgresql12-serverUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-develUpgrade libpq5-32bitUpgrade libecpg6-32bitUpgrade postgresql12Upgrade postgresql12-docsUpgrade postgresql-serverUpgrade postgresql10Upgrade postgresql96-testUpgrade postgresql96-server | Jun 15, 2019 | May 9, 2019 |
| Ubuntu | — | Upgrade postgresql-11Upgrade postgresql-10Upgrade postgresql-9.5 | May 14, 2019 | May 9, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub