A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-plpython3Upgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-staticUpgrade postgresql-plperlUpgrade postgresql-docs | May 4, 2022 | Oct 29, 2019 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql14Upgrade postgresql | Nov 8, 2019 | Oct 29, 2019 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-plperl | Jun 24, 2021 | Oct 29, 2019 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql96Upgrade postgresql94Upgrade postgresql92 | Oct 28, 2020 | Aug 8, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 29, 2019 |
| Centos_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-test-debuginfoUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-debugsourceUpgrade postgresql-server-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-libsUpgrade postgresql-docs-debuginfoUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-develUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plpython3 | Sep 9, 2020 | Oct 29, 2019 |
| Debian | — | Upgrade postgresql-11 | Aug 13, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade postgresql96-serverUpgrade postgresql94-serverUpgrade postgresql10-serverUpgrade postgresql11-serverUpgrade postgresql95-server | Aug 9, 2019 | Aug 8, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-testUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-develUpgrade postgresql-plpythonUpgrade postgresql-libs | Sep 30, 2019 | Aug 8, 2019 |
| Oracle_linux | — | Upgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-develUpgrade postgresql-plpythonUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-testUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-testUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgresqlUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-libsUpgrade postgresql-staticUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-contrib | Sep 10, 2020 | Aug 8, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 11.5 | Aug 9, 2019 | Aug 9, 2019 |
| Redhat_linux | — | Upgrade postgresql-pltclUpgrade postgresql-contrib-debuginfoNo solution existsUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contribUpgrade postgresql-libsUpgrade postgresql-upgradeUpgrade postgresql-develUpgrade postgresql-docs-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-staticUpgrade postgresql-debuginfoUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-server-debuginfoUpgrade postgresql-testUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-docsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperl | Sep 9, 2020 | Oct 29, 2019 |
| Suse | — | Upgrade libpq5Upgrade postgresql96-plpythonUpgrade postgresql12-docsUpgrade postgresql-testUpgrade postgresql96-serverUpgrade postgresql96-testUpgrade postgresql12-plpythonUpgrade postgresql12-serverUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql94-docsUpgrade postgresql10-serverUpgrade postgresqlUpgrade libpq5-32bitUpgrade postgresql12-testUpgrade postgresql12-pltclUpgrade postgresql12-server-develUpgrade postgresql-develUpgrade postgresql12-contribUpgrade postgresql96-plperlUpgrade postgresql94-contribUpgrade libecpg6-32bitUpgrade postgresql94-pltclUpgrade postgresql10-plperlUpgrade postgresql10Upgrade postgresql94Upgrade postgresql94-serverUpgrade postgresql12-plperlUpgrade postgresql96-develUpgrade postgresql10-pltclUpgrade postgresql96-pltclUpgrade postgresql-server-develUpgrade postgresql96-contribUpgrade postgresql-llvmjitUpgrade postgresql-plperlUpgrade postgresql10-testUpgrade postgresql94-plpythonUpgrade libecpg6Upgrade postgresql10-docsUpgrade postgresql12-llvmjitUpgrade postgresql10-develUpgrade postgresql94-plperlUpgrade postgresql12-develUpgrade postgresql10-plpythonUpgrade postgresql-pltclUpgrade postgresql96Upgrade postgresql10-contribUpgrade postgresql12Upgrade postgresql-contribUpgrade postgresql96-docsUpgrade postgresql-plpython | Aug 22, 2019 | Aug 8, 2019 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-9.5Upgrade postgresql-11 | Aug 10, 2019 | Aug 8, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub