CVE-2019-10208

A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 80%
Affected Products (NVD)
VendorProductVersion
postgresqlpostgresql
9.4.0 ≤
𝑥
< 9.4.24
postgresqlpostgresql
9.5.0 ≤
𝑥
< 9.5.19
postgresqlpostgresql
9.6.0 ≤
𝑥
< 9.6.15
postgresqlpostgresql
10.0 ≤
𝑥
< 10.10
postgresqlpostgresql
11.0 ≤
𝑥
< 11.5
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
postgresql-10
bionic
Fixed 10.10-0ubuntu0.18.04.1
released
disco
dne
eoan
dne
trusty
dne
xenial
dne
postgresql-11
bionic
dne
disco
Fixed 11.5-0ubuntu0.19.04.1
released
eoan
Fixed 11.5-1
released
trusty
dne
xenial
dne
postgresql-9.1
bionic
dne
disco
dne
eoan
dne
trusty
dne
xenial
dne
postgresql-9.3
bionic
dne
disco
dne
eoan
dne
trusty
ignored
xenial
dne
postgresql-9.5
bionic
dne
disco
dne
eoan
dne
trusty
dne
xenial
Fixed 9.5.19-0ubuntu0.16.04.1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libecpg6
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise server 12 SP3
10.10-1.15.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
libpq5
suse enterprise desktop 15
10.10-4.16.1
fixed
suse enterprise desktop 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise server 12 SP3
10.10-1.15.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
libpq5-32bit
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise server 12 SP3
10.10-1.15.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
postgresql10
suse enterprise desktop 15
10.10-4.16.1
fixed
suse enterprise desktop 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP3
10.10-8.6.1
fixed
suse enterprise server 12 SP3
10.10-1.15.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP3
10.10-8.6.1
fixed
postgresql10-contrib
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP2
10.10-8.6.1
fixed
suse enterprise sap 15 SP3
10.10-8.6.1
fixed
suse enterprise server 12 SP3
10.10-1.15.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP2
10.10-8.6.1
fixed
suse enterprise server 15 SP3
10.10-8.6.1
fixed
postgresql10-devel
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP2
10.10-8.6.1
fixed
suse enterprise sap 15 SP3
10.10-8.6.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP2
10.10-8.6.1
fixed
suse enterprise server 15 SP3
10.10-8.6.1
fixed
postgresql10-docs
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP2
10.10-8.6.1
fixed
suse enterprise server 12 SP3
10.10-1.15.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP2
10.10-8.6.1
fixed
postgresql10-plperl
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP2
10.10-8.6.1
fixed
suse enterprise sap 15 SP3
10.10-8.6.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP2
10.10-8.6.1
fixed
suse enterprise server 15 SP3
10.10-8.6.1
fixed
postgresql10-plpython
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP2
10.10-8.6.1
fixed
suse enterprise sap 15 SP3
10.10-8.6.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP2
10.10-8.6.1
fixed
suse enterprise server 15 SP3
10.10-8.6.1
fixed
postgresql10-pltcl
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP2
10.10-8.6.1
fixed
suse enterprise sap 15 SP3
10.10-8.6.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP2
10.10-8.6.1
fixed
suse enterprise server 15 SP3
10.10-8.6.1
fixed
postgresql10-server
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP2
10.10-8.6.1
fixed
suse enterprise sap 15 SP3
10.10-8.6.1
fixed
suse enterprise server 12 SP3
10.10-1.15.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP2
10.10-8.6.1
fixed
suse enterprise server 15 SP3
10.10-8.6.1
fixed
postgresql94
suse enterprise sap 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP2
9.4.24-21.25.1
fixed
postgresql94-contrib
suse enterprise sap 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP2
9.4.24-21.25.1
fixed
postgresql94-docs
suse enterprise sap 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP2
9.4.24-21.25.1
fixed
postgresql94-plperl
suse enterprise sap 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP2
9.4.24-21.25.1
fixed
postgresql94-plpython
suse enterprise sap 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP2
9.4.24-21.25.1
fixed
postgresql94-pltcl
suse enterprise sap 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP2
9.4.24-21.25.1
fixed
postgresql94-server
suse enterprise sap 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP2
9.4.24-21.25.1
fixed
postgresql96
suse enterprise sap 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP2
9.6.15-3.29.1
fixed
suse enterprise server 12 SP3
9.6.15-3.29.1
fixed
postgresql96-contrib
suse enterprise sap 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP2
9.6.15-3.29.1
fixed
suse enterprise server 12 SP3
9.6.15-3.29.1
fixed
postgresql96-docs
suse enterprise sap 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP2
9.6.15-3.29.1
fixed
suse enterprise server 12 SP3
9.6.15-3.29.1
fixed
postgresql96-plperl
suse enterprise sap 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP2
9.6.15-3.29.1
fixed
suse enterprise server 12 SP3
9.6.15-3.29.1
fixed
postgresql96-plpython
suse enterprise sap 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP2
9.6.15-3.29.1
fixed
suse enterprise server 12 SP3
9.6.15-3.29.1
fixed
postgresql96-pltcl
suse enterprise sap 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP2
9.6.15-3.29.1
fixed
suse enterprise server 12 SP3
9.6.15-3.29.1
fixed
postgresql96-server
suse enterprise sap 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP2
9.6.15-3.29.1
fixed
suse enterprise server 12 SP3
9.6.15-3.29.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
postgresql
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-contrib
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-devel
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-docs
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-libs
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-plperl
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-plpython
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-pltcl
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-server
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-static
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-test
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-upgrade
RHEL 7
0:9.2.24-6.el7_9
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
postgresql
Amazon Linux 2
0:9.2.24-6.amzn2
fixed
postgresql-contrib
Amazon Linux 2
0:9.2.24-6.amzn2
fixed
postgresql-debuginfo
Amazon Linux 2
0:9.2.24-6.amzn2
fixed
postgresql-devel
Amazon Linux 2
0:9.2.24-6.amzn2
fixed
postgresql-docs
Amazon Linux 2
0:9.2.24-6.amzn2
fixed
postgresql-libs
Amazon Linux 2
0:9.2.24-6.amzn2
fixed
postgresql-plperl
Amazon Linux 2
0:9.2.24-6.amzn2
fixed
postgresql-plpython
Amazon Linux 2
0:9.2.24-6.amzn2
fixed
postgresql-pltcl
Amazon Linux 2
0:9.2.24-6.amzn2
fixed
postgresql-server
Amazon Linux 2
0:9.2.24-6.amzn2
fixed
postgresql-static
Amazon Linux 2
0:9.2.24-6.amzn2
fixed
postgresql-test
Amazon Linux 2
0:9.2.24-6.amzn2
fixed
postgresql-upgrade
Amazon Linux 2
0:9.2.24-6.amzn2
fixed
postgresql92
Amazon Linux 1
0:9.2.24-3.67.amzn1
fixed
postgresql92-contrib
Amazon Linux 1
0:9.2.24-3.67.amzn1
fixed
postgresql92-debuginfo
Amazon Linux 1
0:9.2.24-3.67.amzn1
fixed
postgresql92-devel
Amazon Linux 1
0:9.2.24-3.67.amzn1
fixed
postgresql92-docs
Amazon Linux 1
0:9.2.24-3.67.amzn1
fixed
postgresql92-libs
Amazon Linux 1
0:9.2.24-3.67.amzn1
fixed
postgresql92-plperl
Amazon Linux 1
0:9.2.24-3.67.amzn1
fixed
postgresql92-plpython26
Amazon Linux 1
0:9.2.24-3.67.amzn1
fixed
postgresql92-plpython27
Amazon Linux 1
0:9.2.24-3.67.amzn1
fixed
postgresql92-pltcl
Amazon Linux 1
0:9.2.24-3.67.amzn1
fixed
postgresql92-server
Amazon Linux 1
0:9.2.24-3.67.amzn1
fixed
postgresql92-server-compat
Amazon Linux 1
0:9.2.24-3.67.amzn1
fixed
postgresql92-test
Amazon Linux 1
0:9.2.24-3.67.amzn1
fixed
postgresql94
Amazon Linux 1
0:9.4.26-1.77.amzn1
fixed
postgresql94-contrib
Amazon Linux 1
0:9.4.26-1.77.amzn1
fixed
postgresql94-debuginfo
Amazon Linux 1
0:9.4.26-1.77.amzn1
fixed
postgresql94-devel
Amazon Linux 1
0:9.4.26-1.77.amzn1
fixed
postgresql94-docs
Amazon Linux 1
0:9.4.26-1.77.amzn1
fixed
postgresql94-libs
Amazon Linux 1
0:9.4.26-1.77.amzn1
fixed
postgresql94-plperl
Amazon Linux 1
0:9.4.26-1.77.amzn1
fixed
postgresql94-plpython26
Amazon Linux 1
0:9.4.26-1.77.amzn1
fixed
postgresql94-plpython27
Amazon Linux 1
0:9.4.26-1.77.amzn1
fixed
postgresql94-server
Amazon Linux 1
0:9.4.26-1.77.amzn1
fixed
postgresql94-test
Amazon Linux 1
0:9.4.26-1.77.amzn1
fixed
postgresql95
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-contrib
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-debuginfo
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-devel
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-docs
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-libs
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-plperl
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-plpython26
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-plpython27
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-server
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-static
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-test
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql96
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-contrib
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-debuginfo
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-devel
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-docs
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-libs
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-plperl
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-plpython26
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-plpython27
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-server
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-static
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-test
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10208
https://www.postgresql.org/about/news/1960/
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10208
https://www.postgresql.org/about/news/1960/