Ubuntu update for PostgreSQL

Published: 2019-05-15

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2019-10129 CVE-2019-10130
CWE-ID	CWE-401 CWE-264
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	postgresql-10 (Ubuntu package) Operating systems & Components / Operating system package or component postgresql-9.5 (Ubuntu package) Operating systems & Components / Operating system package or component postgresql-11 (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Memory leak

EUVDB-ID: #VU18423

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-10129

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to read parts of system memory.

The vulnerability exists due memory leak when processing INSERT queries. A remote authenticated user can execute a specially crafted INSERT statement to a partitioned table and read parts of memory.

Mitigation

Update the affected packages.

Ubuntu 19.04: postgresql-11 - 11.3-0ubuntu0.19.04.1
Ubuntu 18.10: postgresql-10 - 10.8-0ubuntu0.18.10.1
Ubuntu 18.04 LTS: postgresql-10 - 10.8-0ubuntu0.18.04.1
Ubuntu 16.04 LTS: postgresql-9.5 - 9.5.17-0ubuntu0.16.04.1

Vulnerable software versions

postgresql-10 (Ubuntu package): 10.6-0ubuntu0.18.04.1 - 10.7-0ubuntu0.18.10.1

postgresql-9.5 (Ubuntu package): 9.5.8-0ubuntu0.16.04.1 - 9.5.16-0ubuntu0.16.04.1

postgresql-11 (Ubuntu package): before 11.3-0ubuntu0.19.04.1

External links

http://usn.ubuntu.com/3972-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18424