CVE-2019-10208

A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 41%
Affected Products (NVD)
VendorProductVersion
postgresqlpostgresql
9.4.0 ≤
𝑥
< 9.4.24
postgresqlpostgresql
9.5.0 ≤
𝑥
< 9.5.19
postgresqlpostgresql
9.6.0 ≤
𝑥
< 9.6.15
postgresqlpostgresql
10.0 ≤
𝑥
< 10.10
postgresqlpostgresql
11.0 ≤
𝑥
< 11.5
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
postgresql-10
bionic
Fixed 10.10-0ubuntu0.18.04.1
released
disco
dne
eoan
dne
trusty
dne
xenial
dne
postgresql-11
bionic
dne
disco
Fixed 11.5-0ubuntu0.19.04.1
released
eoan
Fixed 11.5-1
released
trusty
dne
xenial
dne
postgresql-9.1
bionic
dne
disco
dne
eoan
dne
trusty
dne
xenial
dne
postgresql-9.3
bionic
dne
disco
dne
eoan
dne
trusty
ignored
xenial
dne
postgresql-9.5
bionic
dne
disco
dne
eoan
dne
trusty
dne
xenial
Fixed 9.5.19-0ubuntu0.16.04.1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libecpg6
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise server 12 SP3
10.10-1.15.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
libpq5
suse enterprise desktop 15
10.10-4.16.1
fixed
suse enterprise desktop 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise server 12 SP3
10.10-1.15.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
libpq5-32bit
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise server 12 SP3
10.10-1.15.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
postgresql10
suse enterprise desktop 15
10.10-4.16.1
fixed
suse enterprise desktop 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP3
10.10-8.6.1
fixed
suse enterprise server 12 SP3
10.10-1.15.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP3
10.10-8.6.1
fixed
postgresql10-contrib
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP2
10.10-8.6.1
fixed
suse enterprise sap 15 SP3
10.10-8.6.1
fixed
suse enterprise server 12 SP3
10.10-1.15.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP2
10.10-8.6.1
fixed
suse enterprise server 15 SP3
10.10-8.6.1
fixed
postgresql10-devel
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP2
10.10-8.6.1
fixed
suse enterprise sap 15 SP3
10.10-8.6.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP2
10.10-8.6.1
fixed
suse enterprise server 15 SP3
10.10-8.6.1
fixed
postgresql10-docs
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP2
10.10-8.6.1
fixed
suse enterprise server 12 SP3
10.10-1.15.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP2
10.10-8.6.1
fixed
postgresql10-plperl
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP2
10.10-8.6.1
fixed
suse enterprise sap 15 SP3
10.10-8.6.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP2
10.10-8.6.1
fixed
suse enterprise server 15 SP3
10.10-8.6.1
fixed
postgresql10-plpython
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP2
10.10-8.6.1
fixed
suse enterprise sap 15 SP3
10.10-8.6.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP2
10.10-8.6.1
fixed
suse enterprise server 15 SP3
10.10-8.6.1
fixed
postgresql10-pltcl
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP2
10.10-8.6.1
fixed
suse enterprise sap 15 SP3
10.10-8.6.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP2
10.10-8.6.1
fixed
suse enterprise server 15 SP3
10.10-8.6.1
fixed
postgresql10-server
suse enterprise sap 12 SP4
10.10-1.15.1
fixed
suse enterprise sap 15
10.10-4.16.1
fixed
suse enterprise sap 15 SP1
10.10-8.6.1
fixed
suse enterprise sap 15 SP2
10.10-8.6.1
fixed
suse enterprise sap 15 SP3
10.10-8.6.1
fixed
suse enterprise server 12 SP3
10.10-1.15.1
fixed
suse enterprise server 12 SP4
10.10-1.15.1
fixed
suse enterprise server 15
10.10-4.16.1
fixed
suse enterprise server 15 SP1
10.10-8.6.1
fixed
suse enterprise server 15 SP2
10.10-8.6.1
fixed
suse enterprise server 15 SP3
10.10-8.6.1
fixed
postgresql94
suse enterprise sap 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP2
9.4.24-21.25.1
fixed
postgresql94-contrib
suse enterprise sap 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP2
9.4.24-21.25.1
fixed
postgresql94-docs
suse enterprise sap 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP2
9.4.24-21.25.1
fixed
postgresql94-plperl
suse enterprise sap 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP2
9.4.24-21.25.1
fixed
postgresql94-plpython
suse enterprise sap 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP2
9.4.24-21.25.1
fixed
postgresql94-pltcl
suse enterprise sap 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP2
9.4.24-21.25.1
fixed
postgresql94-server
suse enterprise sap 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP1
9.4.24-21.25.1
fixed
suse enterprise server 12 SP2
9.4.24-21.25.1
fixed
postgresql96
suse enterprise sap 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP2
9.6.15-3.29.1
fixed
suse enterprise server 12 SP3
9.6.15-3.29.1
fixed
postgresql96-contrib
suse enterprise sap 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP2
9.6.15-3.29.1
fixed
suse enterprise server 12 SP3
9.6.15-3.29.1
fixed
postgresql96-docs
suse enterprise sap 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP2
9.6.15-3.29.1
fixed
suse enterprise server 12 SP3
9.6.15-3.29.1
fixed
postgresql96-plperl
suse enterprise sap 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP2
9.6.15-3.29.1
fixed
suse enterprise server 12 SP3
9.6.15-3.29.1
fixed
postgresql96-plpython
suse enterprise sap 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP2
9.6.15-3.29.1
fixed
suse enterprise server 12 SP3
9.6.15-3.29.1
fixed
postgresql96-pltcl
suse enterprise sap 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP2
9.6.15-3.29.1
fixed
suse enterprise server 12 SP3
9.6.15-3.29.1
fixed
postgresql96-server
suse enterprise sap 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP1
9.6.15-3.29.1
fixed
suse enterprise server 12 SP2
9.6.15-3.29.1
fixed
suse enterprise server 12 SP3
9.6.15-3.29.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
postgresql
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-contrib
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-devel
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-docs
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-libs
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-plperl
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-plpython
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-pltcl
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-server
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-static
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-test
RHEL 7
0:9.2.24-6.el7_9
fixed
postgresql-upgrade
RHEL 7
0:9.2.24-6.el7_9
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10208
https://www.postgresql.org/about/news/1960/
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10208
https://www.postgresql.org/about/news/1960/