A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plpython3Upgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-serverUpgrade postgresql-docs | May 4, 2022 | Oct 29, 2019 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresql | Nov 8, 2019 | Oct 29, 2019 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-debuginfoUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresql-docs | Jun 24, 2021 | Oct 29, 2019 |
| Amazon_linux | — | Upgrade postgresql96Upgrade postgresql94Upgrade postgresql95Upgrade postgresql92 | Oct 28, 2020 | Aug 8, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 29, 2019 |
| Centos_linux | — | Upgrade postgresql-upgrade-develUpgrade postgresql-upgradeUpgrade postgresql-contribUpgrade postgresql-server-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-develUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-libsUpgrade postgresql-server-debuginfoUpgrade postgresql-serverUpgrade postgresql-plperl-debuginfoUpgrade postgresql-staticUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-pltclUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-test-rpm-macrosUpgrade postgresql-debugsourceUpgrade postgresqlUpgrade postgresql-docs | Sep 9, 2020 | Oct 29, 2019 |
| Debian | — | Upgrade postgresql-11 | Aug 13, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade postgresql96-serverUpgrade postgresql10-serverUpgrade postgresql11-serverUpgrade postgresql95-serverUpgrade postgresql94-server | Aug 9, 2019 | Aug 8, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-libsUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql | Sep 30, 2019 | Aug 8, 2019 |
| Oracle_linux | — | Upgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresqlUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-plpythonUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-testUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-plpython | Sep 10, 2020 | Aug 8, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 11.5 | Aug 9, 2019 | Aug 9, 2019 |
| Redhat_linux | — | Upgrade postgresql-docsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-staticUpgrade postgresql-debuginfoUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-testUpgrade postgresql-debugsourceUpgrade postgresql-libsUpgrade postgresql-contribUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-develUpgrade postgresql-upgradeUpgrade postgresql-pltclUpgrade postgresql-docs-debuginfoUpgrade postgresql-test-debuginfoNo solution existsUpgrade postgresql-server-develUpgrade postgresql-contrib-debuginfo | Sep 9, 2020 | Oct 29, 2019 |
| Suse | — | Upgrade postgresql10-develUpgrade postgresql12-llvmjitUpgrade postgresql-plperlUpgrade postgresql10-pltclUpgrade postgresql-llvmjitUpgrade postgresql12Upgrade postgresql10-testUpgrade postgresql10-contribUpgrade libecpg6Upgrade postgresql94-plperlUpgrade postgresql-pltclUpgrade postgresql10-docsUpgrade postgresql12-develUpgrade postgresql94-plpythonUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql94Upgrade postgresql-server-develUpgrade postgresql96-docsUpgrade postgresql12-plperlUpgrade postgresql96Upgrade postgresql10-plpythonUpgrade postgresql94-serverUpgrade postgresql96-develUpgrade postgresql96-pltclUpgrade postgresql96-contribUpgrade postgresql96-testUpgrade postgresql12-plpythonUpgrade postgresql96-plperlUpgrade postgresql-docsUpgrade libecpg6-32bitUpgrade postgresql10-serverUpgrade libpq5Upgrade postgresql-serverUpgrade postgresql12-testUpgrade postgresql12-pltclUpgrade postgresql94-pltclUpgrade postgresql10-plperlUpgrade postgresql-testUpgrade postgresql96-serverUpgrade libpq5-32bitUpgrade postgresql10Upgrade postgresql-develUpgrade postgresql12-server-develUpgrade postgresqlUpgrade postgresql12-contribUpgrade postgresql94-contribUpgrade postgresql94-docsUpgrade postgresql96-plpythonUpgrade postgresql12-docsUpgrade postgresql12-server | Aug 22, 2019 | Aug 8, 2019 |
| Ubuntu | — | Upgrade postgresql-11Upgrade postgresql-9.5Upgrade postgresql-10 | Aug 10, 2019 | Aug 8, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub