PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql14Upgrade postgresql | Jul 5, 2019 | Jun 26, 2019 |
| Centos_linux | — | Upgrade postgresql-upgradeUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-upgrade-develUpgrade postgresql-server-debuginfoUpgrade postgresqlUpgrade postgresql-contrib-debuginfoUpgrade postgresql-staticUpgrade postgresql-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-docs-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-devel-debuginfo | Sep 9, 2020 | Jun 26, 2019 |
| Freebsd | — | Upgrade postgresql10-serverUpgrade postgresql11-server | Jun 27, 2019 | Jun 27, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jun 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-develUpgrade postgresql-contrib | Aug 28, 2019 | Jun 26, 2019 |
| Oracle_linux | — | Upgrade postgresql-testUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-contrib-syspaths | Sep 10, 2020 | Jun 20, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 11.4 | Jun 21, 2019 | Jun 21, 2019 |
| Redhat_linux | — | Upgrade postgresql-upgrade-develUpgrade postgresql-server-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-develUpgrade postgresql-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-contrib-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-testUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plperlUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-test-debuginfo | Sep 9, 2020 | Jun 26, 2019 |
| Suse | — | Upgrade libpq5Upgrade postgresql10Upgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql10-pltclUpgrade postgresql10-contribUpgrade postgresql-plpythonUpgrade postgresql12-plperlUpgrade postgresql10-docsUpgrade postgresql10-develUpgrade postgresql10-plpythonUpgrade libecpg6Upgrade postgresql12Upgrade python3-psycopg2Upgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql12-server-develUpgrade postgresql10-serverUpgrade postgresql12-pltclUpgrade postgresql12-plpythonUpgrade postgresql10-testUpgrade libpq5-32bitUpgrade postgresql12-serverUpgrade libecpg6-32bitUpgrade postgresql12-contribUpgrade postgresql10-plperlUpgrade postgresql12-docsUpgrade postgresql12-develUpgrade postgresql-docs | Jul 10, 2019 | Jun 20, 2019 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-11 | Jun 21, 2019 | Jun 20, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub