Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.
From VID-065890C3-725E-11E9-B0E1-6CC21735F730:
The PostgreSQL project reports:
PostgreSQL maintains statistics for tables by sampling
data available in columns; this data is consulted during
the query planning process. Prior to this release, a user
able to execute SQL queries with permissions to read a
given column could craft a leaky operator that could
read whatever data had been sampled from that column.
If this happened to include values from rows that the user
is forbidden to see by a row security policy, the user
could effectively bypass the policy. This is fixed by only
allowing a non-leakproof operator to use this data if
there are no relevant row security policies for the table.
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center