A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-staticUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade postgresql-pltcl | May 4, 2022 | Oct 29, 2019 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql15Upgrade postgresql14 | Nov 8, 2019 | Oct 29, 2019 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-develUpgrade postgresql-plpythonUpgrade postgresql-debuginfoUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-upgradeUpgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-static | Jun 24, 2021 | Oct 29, 2019 |
| Amazon_linux | — | Upgrade postgresql92Upgrade postgresql96Upgrade postgresql95Upgrade postgresql94 | Oct 28, 2020 | Aug 8, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 29, 2019 |
| Centos_linux | — | Upgrade postgresql-contribUpgrade postgresql-server-develUpgrade postgresql-upgrade-develUpgrade postgresql-upgradeUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-develUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-staticUpgrade postgresql-test-debuginfoUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-docs-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-debuginfo | Sep 9, 2020 | Oct 29, 2019 |
| Debian | — | Upgrade postgresql-11 | Aug 13, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade postgresql11-serverUpgrade postgresql94-serverUpgrade postgresql95-serverUpgrade postgresql10-serverUpgrade postgresql96-server | Aug 9, 2019 | Aug 8, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresqlUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-plperlUpgrade postgresql-contrib | Sep 30, 2019 | Aug 8, 2019 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresqlUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-staticUpgrade postgresql-libsUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-plpythonUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-testUpgrade postgresql-serverUpgrade postgresql-develUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql | Sep 10, 2020 | Aug 8, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 11.5 | Aug 9, 2019 | Aug 9, 2019 |
| Redhat_linux | — | Upgrade postgresql-test-debuginfoNo solution existsUpgrade postgresql-develUpgrade postgresql-upgradeUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-libsUpgrade postgresql-plpython3Upgrade postgresql-contribUpgrade postgresql-server-develUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-pltclUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-server-debuginfoUpgrade postgresql-plperlUpgrade postgresql-debuginfoUpgrade postgresql-serverUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-testUpgrade postgresql-docs | Sep 9, 2020 | Oct 29, 2019 |
| Suse | — | Upgrade libpq5Upgrade postgresql12-plpythonUpgrade postgresql10-plperlUpgrade libpq5-32bitUpgrade postgresql94-pltclUpgrade postgresql10Upgrade postgresql-docsUpgrade postgresql12-server-develUpgrade postgresqlUpgrade postgresql94-contribUpgrade postgresql-develUpgrade postgresql12-docsUpgrade postgresql10-serverUpgrade postgresql94-docsUpgrade postgresql96-testUpgrade libecpg6-32bitUpgrade postgresql96-serverUpgrade postgresql96-plpythonUpgrade postgresql12-pltclUpgrade postgresql12-contribUpgrade postgresql-testUpgrade postgresql12-testUpgrade postgresql12-serverUpgrade postgresql96-plperlUpgrade postgresql-serverUpgrade postgresql10-docsUpgrade postgresql10-pltclUpgrade postgresql94Upgrade postgresql96Upgrade postgresql94-serverUpgrade postgresql96-pltclUpgrade postgresql12-develUpgrade postgresql-pltclUpgrade postgresql96-docsUpgrade postgresql-contribUpgrade postgresql96-develUpgrade postgresql-server-develUpgrade postgresql12-plperlUpgrade postgresql10-plpythonUpgrade postgresql12-llvmjitUpgrade postgresql-llvmjitUpgrade postgresql96-contribUpgrade postgresql-plperlUpgrade postgresql10-testUpgrade postgresql10-develUpgrade postgresql12Upgrade postgresql10-contribUpgrade postgresql94-plpythonUpgrade postgresql94-plperlUpgrade postgresql-plpythonUpgrade libecpg6 | Aug 22, 2019 | Aug 8, 2019 |
| Ubuntu | — | Upgrade postgresql-11Upgrade postgresql-9.5Upgrade postgresql-10 | Aug 10, 2019 | Aug 8, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub