Permissions, Privileges, and Access Controls in PostgreSQL - CVE-2019-10130

Vulnerability identifier: #VU18424

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-10130

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to incorrect implementation of row security policies. A remote attacker can use statistics, generated for tables to bypass row security policies and gain access to restricted rows.

PostgreSQL
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Opensuse
openEuler
Anolis OS
IBM Observability with Instana
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
postgresql (Alpine package)
postgresql-9.5 (Ubuntu package)
postgresql-9.6 (Debian package)
postgresql-10 (Ubuntu package)
rh-postgresql96-postgresql (Red Hat package)
postgresql-11 (Ubuntu package)
postgresql-test
postgresql-plperl
postgresql-llvmjit
postgresql-docs
postgresql-debugsource
postgresql-debuginfo
postgresql-contrib
postgresql
postgresql-test-rpm-macros
postgresql-plpython3
postgresql-static
postgresql-server-devel
postgresql-server
postgresql-private-libs
postgresql-private-devel
postgresql-pltcl
libpq-debuginfo
libpq
libpq-devel
libpq-debugsource
postgresql-upgrade
postgresql-upgrade-devel
Dell Security Management Server

Install updates from vendor's website.

PostgreSQL - addressed in versions 9.4.22, 9.5.17, 9.6.13, 10.8, 11.3
IBM Observability with Instana - update to 1.0.309
postgresql (Alpine package) - update to 9.6.13-r0
postgresql-9.5 (Ubuntu package) - update to 9.5.17-0ubuntu0.16.04.1
postgresql-9.6 (Debian package) - update to 9.6.13-0+deb9u1
postgresql-10 (Ubuntu package) - addressed in versions 10.8-0ubuntu0.18.04.1, 10.8-0ubuntu0.18.10.1
rh-postgresql96-postgresql (Red Hat package) - update to 9.6.19-1.el7
Dell Security Management Server - update to 11.0.1
postgresql-11 (Ubuntu package) - update to 11.3-0ubuntu0.19.04.1
postgresql-test - addressed in versions 13.22-1, 15.14-1
postgresql-plperl - addressed in versions 13.22-1, 15.14-1
postgresql-llvmjit - addressed in versions 13.22-1, 15.14-1
postgresql-docs - addressed in versions 13.22-1, 15.14-1
postgresql-debugsource - addressed in versions 13.22-1, 15.14-1
postgresql-debuginfo - addressed in versions 13.22-1, 15.14-1
postgresql-contrib - addressed in versions 13.22-1, 15.14-1
postgresql - addressed in versions 13.22-1, 15.14-1
postgresql-test-rpm-macros - addressed in versions 13.22-1, 15.14-1
postgresql-plpython3 - addressed in versions 13.22-1, 15.14-1
postgresql-static - addressed in versions 13.22-1, 15.14-1
postgresql-server-devel - addressed in versions 13.22-1, 15.14-1
postgresql-server - addressed in versions 13.22-1, 15.14-1
postgresql-private-libs - addressed in versions 13.22-1, 15.14-1
postgresql-private-devel - addressed in versions 13.22-1, 15.14-1
postgresql-pltcl - addressed in versions 13.22-1, 15.14-1
libpq-debuginfo - addressed in versions 13.22-1, 15.14-1
libpq - addressed in versions 13.22-1, 15.14-1
libpq-devel - addressed in versions 13.22-1, 15.14-1
libpq-debugsource - addressed in versions 13.22-1, 15.14-1
postgresql-plpython3 - update to 15.14-1
postgresql-pltcl - update to 15.14-1
postgresql-private-devel - update to 15.14-1
postgresql-private-libs - update to 15.14-1
postgresql-server - update to 15.14-1
postgresql-server-devel - update to 15.14-1
postgresql-static - update to 15.14-1
postgresql-test - update to 15.14-1
postgresql-upgrade - update to 15.14-1
postgresql-upgrade-devel - update to 15.14-1
postgresql-test-rpm-macros - update to 15.14-1
postgresql-plperl - update to 15.14-1
postgresql - update to 15.14-1
postgresql-contrib - update to 15.14-1
postgresql-docs - update to 15.14-1

• https://www.postgresql.org/about/news/1939/

• Multiple vulnerabilities in PostgreSQL
• Debian update for postgresql-9.6
• Ubuntu update for PostgreSQL
• OpenSUSE Linux update for postgresql10
• OpenSUSE Linux update for postgresql96
• OpenSUSE Linux update for postgresql10
• Gentoo update for PostgreSQL
• OpenSUSE Linux update for postgresql96, postgresql10 and postgresql12
• Permissions, Privileges, and Access Controls in postgresql (Alpine package)
• Amazon Linux AMI update for postgresql96
• Amazon Linux AMI update for postgresql95
• Red Hat Enterprise Linux 8 update for the postgresql:9.6 module
• Red Hat Enterprise Linux 8 update for the postgresql:9.6 module
• Red Hat Enterprise Linux 8 update for the postgresql:10 module
• Red Hat Enterprise Linux 8.2 update for the postgresql:9.6 module
• Red Hat Enterprise Linux 8.1 update for the postgresql:10 module
• Red Hat Enterprise Linux 8.1 update for the postgresql:9.6 module
• Multiple vulnerabilities in Dell Security Management
• Red Hat Software Collections update for rh-postgresql96-postgresql
• Red Hat Enterprise Linux 8 update for the postgresql:10 module
• openEuler 24.03 LTS SP2 update for postgresql
• openEuler 24.03 LTS SP1 update for postgresql
• openEuler 22.03 LTS SP4 update for postgresql
• openEuler 22.03 LTS SP3 update for postgresql
• openEuler 24.03 LTS SP2 update for libpq
• openEuler 24.03 LTS SP1 update for libpq
• openEuler 22.03 LTS SP4 update for libpq
• openEuler 22.03 LTS SP3 update for libpq
• openEuler 24.03 LTS update for libpq
• openEuler 24.03 LTS update for postgresql
• Anolis OS update for postgresql
• Multiple vulnerabilities in IBM Observability with Instana