A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-plpython3Upgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-server | May 4, 2022 | Oct 29, 2019 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql14Upgrade postgresql15 | Nov 8, 2019 | Oct 29, 2019 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-upgradeUpgrade postgresql-server | Jun 24, 2021 | Oct 29, 2019 |
| Amazon_linux | — | Upgrade postgresql94Upgrade postgresql96Upgrade postgresql95Upgrade postgresql92 | Oct 28, 2020 | Aug 8, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 29, 2019 |
| Centos_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgresql-plperl-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-staticUpgrade postgresql-debugsourceUpgrade postgresql-plpythonUpgrade postgresql-docs-debuginfoUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-debuginfoUpgrade postgresql-plperlUpgrade postgresql-server-debuginfoUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgresql-server-devel | Sep 9, 2020 | Oct 29, 2019 |
| Debian | — | Upgrade postgresql-11 | Aug 13, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade postgresql96-serverUpgrade postgresql95-serverUpgrade postgresql94-serverUpgrade postgresql11-serverUpgrade postgresql10-server | Aug 9, 2019 | Aug 8, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-plpythonUpgrade postgresql-libsUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresqlUpgrade postgresql-test | Sep 30, 2019 | Aug 8, 2019 |
| Oracle_linux | — | Upgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-develUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-testUpgrade rh-postgresql10-postgresql-testUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresqlUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql-libsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-docs | Sep 10, 2020 | Aug 8, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 11.5 | Aug 9, 2019 | Aug 9, 2019 |
| Redhat_linux | — | No solution existsUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-libsUpgrade postgresql-develUpgrade postgresql-plpython3Upgrade postgresql-pltclUpgrade postgresql-upgradeUpgrade postgresql-plperl-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-test-rpm-macrosUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-debugsourceUpgrade postgresql-staticUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-docsUpgrade postgresql-server-debuginfoUpgrade postgresqlUpgrade postgresql-debuginfo | Sep 9, 2020 | Oct 29, 2019 |
| Suse | — | Upgrade postgresql94-docsUpgrade libpq5Upgrade postgresql94-contribUpgrade postgresql-docsUpgrade postgresql10-serverUpgrade postgresql12-server-develUpgrade postgresql12-contribUpgrade postgresql96-testUpgrade postgresql-serverUpgrade postgresql10-plperlUpgrade postgresql96-serverUpgrade postgresql10Upgrade postgresql96-plperlUpgrade postgresql96-plpythonUpgrade libpq5-32bitUpgrade libecpg6-32bitUpgrade postgresql94-pltclUpgrade postgresql12-docsUpgrade postgresql-develUpgrade postgresql12-pltclUpgrade postgresql-testUpgrade postgresql12-serverUpgrade postgresql12-plpythonUpgrade postgresql12-testUpgrade postgresqlUpgrade postgresql10-pltclUpgrade postgresql96-develUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresql12-develUpgrade postgresql94-plpythonUpgrade libecpg6Upgrade postgresql-llvmjitUpgrade postgresql10-testUpgrade postgresql96-pltclUpgrade postgresql96Upgrade postgresql10-plpythonUpgrade postgresql96-contribUpgrade postgresql-plperlUpgrade postgresql12-llvmjitUpgrade postgresql10-develUpgrade postgresql10-docsUpgrade postgresql94-plperlUpgrade postgresql-plpythonUpgrade postgresql94Upgrade postgresql12Upgrade postgresql10-contribUpgrade postgresql96-docsUpgrade postgresql-contribUpgrade postgresql94-serverUpgrade postgresql12-plperl | Aug 22, 2019 | Aug 8, 2019 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-11Upgrade postgresql-10 | Aug 10, 2019 | Aug 8, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub