PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-postgresqlalpine-linux-upgrade-postgresql14alpine-linux-upgrade-postgresql15 | Jul 5, 2019 | Jun 26, 2019 | |
| Centos_linux | — | centos-upgrade-postgresqlcentos-upgrade-postgresql-contribcentos-upgrade-postgresql-contrib-debuginfocentos-upgrade-postgresql-debuginfocentos-upgrade-postgresql-debugsourcecentos-upgrade-postgresql-docscentos-upgrade-postgresql-docs-debuginfocentos-upgrade-postgresql-plperlcentos-upgrade-postgresql-plperl-debuginfocentos-upgrade-postgresql-plpython3centos-upgrade-postgresql-plpython3-debuginfocentos-upgrade-postgresql-pltclcentos-upgrade-postgresql-pltcl-debuginfocentos-upgrade-postgresql-servercentos-upgrade-postgresql-server-debuginfocentos-upgrade-postgresql-server-develcentos-upgrade-postgresql-server-devel-debuginfocentos-upgrade-postgresql-staticcentos-upgrade-postgresql-testcentos-upgrade-postgresql-test-debuginfocentos-upgrade-postgresql-test-rpm-macroscentos-upgrade-postgresql-upgradecentos-upgrade-postgresql-upgrade-debuginfocentos-upgrade-postgresql-upgrade-develcentos-upgrade-postgresql-upgrade-devel-debuginfo | Sep 9, 2020 | Jun 26, 2019 |
| Freebsd | freebsd-upgrade-package-postgresql11-serverfreebsd-upgrade-package-postgresql10-server | Jun 27, 2019 | Jun 27, 2019 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-db-postgresql | Mar 13, 2020 | Jun 26, 2019 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-postgresqlhuawei-euleros-2_0_sp8-upgrade-postgresql-contribhuawei-euleros-2_0_sp8-upgrade-postgresql-develhuawei-euleros-2_0_sp8-upgrade-postgresql-docshuawei-euleros-2_0_sp8-upgrade-postgresql-libshuawei-euleros-2_0_sp8-upgrade-postgresql-plperlhuawei-euleros-2_0_sp8-upgrade-postgresql-plpythonhuawei-euleros-2_0_sp8-upgrade-postgresql-pltclhuawei-euleros-2_0_sp8-upgrade-postgresql-serverhuawei-euleros-2_0_sp8-upgrade-postgresql-test | Aug 28, 2019 | Jun 26, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-postgresqloracle-linux-upgrade-postgresql-contriboracle-linux-upgrade-postgresql-docsoracle-linux-upgrade-postgresql-plperloracle-linux-upgrade-postgresql-plpython3oracle-linux-upgrade-postgresql-pltcloracle-linux-upgrade-postgresql-serveroracle-linux-upgrade-postgresql-server-develoracle-linux-upgrade-postgresql-staticoracle-linux-upgrade-postgresql-testoracle-linux-upgrade-postgresql-test-rpm-macrosoracle-linux-upgrade-postgresql-upgradeoracle-linux-upgrade-postgresql-upgrade-develoracle-linux-upgrade-rh-postgresql10-postgresqloracle-linux-upgrade-rh-postgresql10-postgresql-contriboracle-linux-upgrade-rh-postgresql10-postgresql-contrib-syspathsoracle-linux-upgrade-rh-postgresql10-postgresql-develoracle-linux-upgrade-rh-postgresql10-postgresql-docsoracle-linux-upgrade-rh-postgresql10-postgresql-libsoracle-linux-upgrade-rh-postgresql10-postgresql-plperloracle-linux-upgrade-rh-postgresql10-postgresql-plpythonoracle-linux-upgrade-rh-postgresql10-postgresql-pltcloracle-linux-upgrade-rh-postgresql10-postgresql-serveroracle-linux-upgrade-rh-postgresql10-postgresql-server-syspathsoracle-linux-upgrade-rh-postgresql10-postgresql-staticoracle-linux-upgrade-rh-postgresql10-postgresql-syspathsoracle-linux-upgrade-rh-postgresql10-postgresql-test | Sep 10, 2020 | Jun 20, 2019 |
| Postgres | postgres-upgrade-11_4 | Jun 21, 2019 | Jun 21, 2019 | |
| Redhat_linux | redhat-upgrade-postgresqlredhat-upgrade-postgresql-contribredhat-upgrade-postgresql-contrib-debuginforedhat-upgrade-postgresql-debuginforedhat-upgrade-postgresql-debugsourceredhat-upgrade-postgresql-docsredhat-upgrade-postgresql-docs-debuginforedhat-upgrade-postgresql-plperlredhat-upgrade-postgresql-plperl-debuginforedhat-upgrade-postgresql-plpython3redhat-upgrade-postgresql-plpython3-debuginforedhat-upgrade-postgresql-pltclredhat-upgrade-postgresql-pltcl-debuginforedhat-upgrade-postgresql-serverredhat-upgrade-postgresql-server-debuginforedhat-upgrade-postgresql-server-develredhat-upgrade-postgresql-server-devel-debuginforedhat-upgrade-postgresql-staticredhat-upgrade-postgresql-testredhat-upgrade-postgresql-test-debuginforedhat-upgrade-postgresql-test-rpm-macrosredhat-upgrade-postgresql-upgraderedhat-upgrade-postgresql-upgrade-debuginforedhat-upgrade-postgresql-upgrade-develredhat-upgrade-postgresql-upgrade-devel-debuginfo | Sep 9, 2020 | Jun 26, 2019 | |
| Suse | — | suse-upgrade-libecpg6suse-upgrade-libecpg6-32bitsuse-upgrade-libpq5suse-upgrade-libpq5-32bitsuse-upgrade-postgresqlsuse-upgrade-postgresql-contribsuse-upgrade-postgresql-develsuse-upgrade-postgresql-docssuse-upgrade-postgresql-plperlsuse-upgrade-postgresql-plpythonsuse-upgrade-postgresql-pltclsuse-upgrade-postgresql-serversuse-upgrade-postgresql-server-develsuse-upgrade-postgresql10suse-upgrade-postgresql10-contribsuse-upgrade-postgresql10-develsuse-upgrade-postgresql10-docssuse-upgrade-postgresql10-plperlsuse-upgrade-postgresql10-plpythonsuse-upgrade-postgresql10-pltclsuse-upgrade-postgresql10-serversuse-upgrade-postgresql10-testsuse-upgrade-postgresql12suse-upgrade-postgresql12-contribsuse-upgrade-postgresql12-develsuse-upgrade-postgresql12-docssuse-upgrade-postgresql12-plperlsuse-upgrade-postgresql12-plpythonsuse-upgrade-postgresql12-pltclsuse-upgrade-postgresql12-serversuse-upgrade-postgresql12-server-develsuse-upgrade-python3-psycopg2 | Jul 10, 2019 | Jun 20, 2019 |
| Ubuntu | ubuntu-upgrade-postgresql-10ubuntu-upgrade-postgresql-11 | Jun 21, 2019 | Jun 20, 2019 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jun 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub