PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql14Upgrade postgresql | Jul 5, 2019 | Jun 26, 2019 |
| Centos_linux | — | Upgrade postgresql-upgrade-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contribUpgrade postgresql-debuginfoUpgrade postgresql-pltclUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-testUpgrade postgresql-contrib-debuginfoUpgrade postgresql-docsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-upgrade-develUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-debugsourceUpgrade postgresql-plpython3-debuginfo | Sep 9, 2020 | Jun 26, 2019 |
| Freebsd | — | Upgrade postgresql10-serverUpgrade postgresql11-server | Jun 27, 2019 | Jun 27, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jun 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-server | Aug 28, 2019 | Jun 26, 2019 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-testUpgrade postgresql-docsUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-devel | Sep 10, 2020 | Jun 20, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 11.4 | Jun 21, 2019 | Jun 21, 2019 |
| Redhat_linux | — | Upgrade postgresql-pltclUpgrade postgresql-test-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresql-plperl-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-serverUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-plperlUpgrade postgresql-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-debuginfoUpgrade postgresqlUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-server-develUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-static | Sep 9, 2020 | Jun 26, 2019 |
| Suse | — | Upgrade postgresql-plperlUpgrade postgresql12Upgrade postgresql-pltclUpgrade postgresql10-pltclUpgrade postgresql10-plpythonUpgrade python3-psycopg2Upgrade libpq5Upgrade postgresql12-plperlUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql10Upgrade postgresql-develUpgrade postgresql10-develUpgrade postgresql10-contribUpgrade postgresql-plpythonUpgrade postgresql10-docsUpgrade postgresql-server-develUpgrade libecpg6Upgrade postgresql-docsUpgrade postgresql10-serverUpgrade postgresql12-plpythonUpgrade postgresql12-develUpgrade postgresql12-docsUpgrade postgresql10-plperlUpgrade libecpg6-32bitUpgrade postgresql12-server-develUpgrade postgresql12-pltclUpgrade postgresqlUpgrade postgresql12-serverUpgrade postgresql10-testUpgrade libpq5-32bitUpgrade postgresql12-contrib | Jul 10, 2019 | Jun 20, 2019 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-11 | Jun 21, 2019 | Jun 20, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub