A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- CVSS 3.0 Base Score: 3.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgresql-server-develUpgrade postgresql-contrib | May 4, 2022 | Jul 30, 2019 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql15Upgrade postgresql14 | Aug 22, 2024 | Jul 30, 2019 |
| Amazon_linux | — | Upgrade postgresql96Upgrade postgresql95 | Oct 28, 2020 | May 9, 2019 |
| Centos_linux | — | Upgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contribUpgrade postgresql-contrib-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-pltcl-debuginfoUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade postgresql-plperlUpgrade postgresql-server-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-server-devel | Sep 9, 2020 | Jul 30, 2019 |
| Debian | — | Upgrade postgresql-11 | May 10, 2019 | May 10, 2019 |
| Freebsd | — | Upgrade postgresql95-serverUpgrade postgresql10-serverUpgrade postgresql11-serverUpgrade postgresql96-server | May 11, 2019 | May 9, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jul 30, 2019 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresqlUpgrade rh-postgresql10-postgresql-testUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-server-develUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-upgradeUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-docsUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresqlUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql-upgrade-develUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-contrib | Sep 10, 2020 | May 9, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 10.8Upgrade to PostgreSQL version 9.6.13Upgrade to PostgreSQL version 9.5.17Upgrade to PostgreSQL version 11.3 | Jun 26, 2019 | Jun 26, 2019 |
| Redhat_linux | — | Upgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-server-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-contrib-debuginfoUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-testUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-plperl-debuginfo | Sep 9, 2020 | Jul 30, 2019 |
| Suse | — | Upgrade postgresql-serverUpgrade postgresql10Upgrade postgresql12Upgrade postgresql-plperlUpgrade postgresql96-serverUpgrade postgresql12-docsUpgrade postgresql12-contribUpgrade postgresql12-serverUpgrade libpq5-32bitUpgrade postgresqlUpgrade postgresql-develUpgrade libecpg6-32bitUpgrade libpq5Upgrade postgresql-docsUpgrade postgresql10-serverUpgrade postgresql-testUpgrade postgresql96-testUpgrade postgresql10-docsUpgrade postgresql-llvmjitUpgrade postgresql12-llvmjitUpgrade libecpg6Upgrade postgresql12-testUpgrade postgresql-contribUpgrade postgresql10-pltclUpgrade postgresql10-plperlUpgrade postgresql-pltclUpgrade postgresql96-plpythonUpgrade postgresql-server-develUpgrade postgresql10-develUpgrade postgresql96-contribUpgrade postgresql12-pltclUpgrade postgresql12-plpythonUpgrade postgresql12-server-develUpgrade postgresql96Upgrade postgresql96-develUpgrade postgresql10-contribUpgrade postgresql12-develUpgrade postgresql12-plperlUpgrade postgresql-plpythonUpgrade postgresql96-docsUpgrade postgresql96-plperlUpgrade postgresql10-plpythonUpgrade postgresql96-pltclUpgrade postgresql10-test | Jun 15, 2019 | May 9, 2019 |
| Ubuntu | — | Upgrade postgresql-11Upgrade postgresql-9.5Upgrade postgresql-10 | May 14, 2019 | May 9, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub