PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresqlUpgrade postgresql14 | Jul 5, 2019 | Jun 26, 2019 |
| Centos_linux | — | Upgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-test-debuginfoUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-staticUpgrade postgresql-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-debuginfoUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-plperl | Sep 9, 2020 | Jun 26, 2019 |
| Freebsd | — | Upgrade postgresql10-serverUpgrade postgresql11-server | Jun 27, 2019 | Jun 27, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jun 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-develUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-plpython | Aug 28, 2019 | Jun 26, 2019 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-staticUpgrade postgresqlUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-test-rpm-macrosUpgrade postgresql-testUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-upgrade-develUpgrade postgresql-docs | Sep 10, 2020 | Jun 20, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 11.4 | Jun 21, 2019 | Jun 21, 2019 |
| Redhat_linux | — | Upgrade postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade postgresql-staticUpgrade postgresql-server-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-docsUpgrade postgresql-server-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresqlUpgrade postgresql-plpython3Upgrade postgresql-serverUpgrade postgresql-test-debuginfoUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-docs-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-testUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-contrib-debuginfo | Sep 9, 2020 | Jun 26, 2019 |
| Suse | — | Upgrade postgresql10-develUpgrade libecpg6Upgrade postgresql-develUpgrade postgresql-serverUpgrade postgresql-plpythonUpgrade postgresql12Upgrade postgresql10-docsUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresql10-contribUpgrade libpq5Upgrade postgresql10-pltclUpgrade postgresql-pltclUpgrade postgresql10-plpythonUpgrade python3-psycopg2Upgrade postgresql12-plperlUpgrade postgresql10Upgrade postgresql-contribUpgrade postgresql12-plpythonUpgrade postgresql12-docsUpgrade postgresql12-develUpgrade postgresql10-serverUpgrade postgresql12-server-develUpgrade postgresql10-testUpgrade postgresql12-serverUpgrade libpq5-32bitUpgrade postgresqlUpgrade libecpg6-32bitUpgrade postgresql-docsUpgrade postgresql12-contribUpgrade postgresql10-plperlUpgrade postgresql12-pltcl | Jul 10, 2019 | Jun 20, 2019 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-11 | Jun 21, 2019 | Jun 20, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub