PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresqlUpgrade postgresql15 | Jul 5, 2019 | Jun 26, 2019 |
| Centos_linux | — | Upgrade postgresql-server-devel-debuginfoUpgrade postgresqlUpgrade postgresql-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-testUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-docsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-staticUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-docs-debuginfoUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-test-rpm-macros | Sep 9, 2020 | Jun 26, 2019 |
| Freebsd | — | Upgrade postgresql11-serverUpgrade postgresql10-server | Jun 27, 2019 | Jun 27, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jun 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-pltcl | Aug 28, 2019 | Jun 26, 2019 |
| Oracle_linux | — | Upgrade postgresql-contribUpgrade postgresql-testUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-staticUpgrade postgresqlUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-devel | Sep 10, 2020 | Jun 20, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 11.4 | Jun 21, 2019 | Jun 21, 2019 |
| Redhat_linux | — | Upgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-plperlUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-testUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-serverUpgrade postgresql-docs-debuginfoUpgrade postgresql-pltclUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-docsUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresqlUpgrade postgresql-server-develUpgrade postgresql-upgrade-develUpgrade postgresql-staticUpgrade postgresql-debuginfoUpgrade postgresql-contrib | Sep 9, 2020 | Jun 26, 2019 |
| Suse | — | Upgrade libpq5-32bitUpgrade postgresql12-serverUpgrade libecpg6-32bitUpgrade postgresql12-contribUpgrade postgresql10-testUpgrade postgresql12-server-develUpgrade postgresql12-develUpgrade postgresql12-pltclUpgrade postgresql-docsUpgrade postgresql10-plperlUpgrade postgresql10-serverUpgrade postgresqlUpgrade postgresql12-docsUpgrade postgresql12-plpythonUpgrade postgresql10-plpythonUpgrade postgresql10-docsUpgrade postgresql-develUpgrade postgresql-serverUpgrade python3-psycopg2Upgrade postgresql-plpythonUpgrade postgresql10-develUpgrade postgresql10-pltclUpgrade postgresql-server-develUpgrade libpq5Upgrade postgresql10-contribUpgrade postgresql-pltclUpgrade libecpg6Upgrade postgresql-contribUpgrade postgresql10Upgrade postgresql12-plperlUpgrade postgresql-plperlUpgrade postgresql12 | Jul 10, 2019 | Jun 20, 2019 |
| Ubuntu | — | Upgrade postgresql-11Upgrade postgresql-10 | Jun 21, 2019 | Jun 20, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub