Permissions, Privileges, and Access Controls in PostgreSQL - CVE-2019-10208

Vulnerability identifier: #VU20003

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-10208

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to way PostreSQL processes SECURITY DEFINER functions. A privileged attacker with EXECUTE permission, which must itself contain a function call having inexact argument type match, can execute arbitrary SQL query under the identity of the function owner.

PostgreSQL
Amazon Linux AMI
Arch Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
CentOS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Opensuse
Fedora
postgresql (Alpine package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
postgresql (Red Hat package)
postgresql-9.5 (Ubuntu package)
postgresql-9.6 (Debian package)
postgresql-10 (Ubuntu package)
postgresql-11 (Debian package)
postgresql-11 (Ubuntu package)
rh-postgresql96-postgresql (Red Hat package)
postgresql
libpq
BIG-IQ Centralized Management
IBM Security Verify Access
EMC NetWorker Server

Install updates from vendor's website.

PostgreSQL - addressed in versions 9.4.24, 9.5.19, 9.6.15, 10.10, 11.5
postgresql (Red Hat package) - update to 9.2.24-6.el7_9
postgresql (Alpine package) - addressed in versions 10.10-r0, 11.5-r0
postgresql-9.5 (Ubuntu package) - update to 9.5.19-0ubuntu0.16.04.1
postgresql-9.6 (Debian package) - update to 9.6.15-0+deb9u1
postgresql-10 (Ubuntu package) - update to 10.10-0ubuntu0.18.04.1
postgresql-11 (Debian package) - update to 11.5-1+deb10u1
postgresql-11 (Ubuntu package) - update to 11.5-0ubuntu0.19.04.1
rh-postgresql96-postgresql (Red Hat package) - update to 9.6.19-1.el7
postgresql - addressed in versions 10.10-1.fc29, 11.5-1.fc30
libpq - update to 11.5-1.fc30
EMC NetWorker Server - addressed in versions 19.6.1.3, 19.7.0.1

• https://www.postgresql.org/about/news/1960/

• Multiple vulnerabilities in PostgreSQL
• Ubuntu update for PostgreSQL
• Debian update for postgresql-11
• Debian update for postgresql-9.6
• Arch Linux update for postgresql-libs
• Arch Linux update for postgresql
• OpenSUSE Linux update for postgresql10
• OpenSUSE Linux update for SUSE Manager Client Tools
• OpenSUSE Linux update for postgresql96, postgresql10 and postgresql12
• Permissions, Privileges, and Access Controls in postgresql (Alpine package)
• Amazon Linux AMI update for postgresql96
• Amazon Linux AMI update for postgresql95
• Amazon Linux AMI update for postgresql94
• Red Hat Enterprise Linux 8 update for the postgresql:9.6 module
• Red Hat Enterprise Linux 8 update for the postgresql:9.6 module
• Red Hat Enterprise Linux 8 update for the postgresql:10 module
• Red Hat Enterprise Linux 8.2 update for the postgresql:9.6 module
• Red Hat Enterprise Linux 8.1 update for the postgresql:10 module
• Red Hat Enterprise Linux 8.1 update for the postgresql:9.6 module
• Red Hat Enterprise Linux 7 update for postgresql
• CentOS 7 update for postgresql
• CentOS 7 update for postgresql
• Amazon Linux AMI update for postgresql92
• Multiple vulnerabilities in IBM Security Access Manager
• Multiple vulnerabilities in Dell NetWorker
• Red Hat Software Collections update for rh-postgresql96-postgresql
• Improper privilege management in F5 BIG-IQ Centralized Management BIG-IQ component
• Red Hat Enterprise Linux 8 update for the postgresql:10 module
• Fedora 30 update for libpq, postgresql
• Fedora 29 update for postgresql