Information disclosure in PostgreSQL - CVE-2019-10209

Vulnerability identifier: #VU20004

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-10209

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to way PostgreSQL processes user-defined hash equality operators. A remote attacker can under certain circumstances read arbitrary bytes from server memory.

Note, exploitation of this vulnerability requires a superuser to create unusual operators.

PostgreSQL
Arch Linux
Opensuse
Fedora
postgresql-9.5 (Ubuntu package)
postgresql-10 (Ubuntu package)
postgresql-11 (Debian package)
postgresql (Alpine package)
postgresql-11 (Ubuntu package)
postgresql
libpq

Install updates from vendor's website.

PostgreSQL - update to 11.5
postgresql-9.5 (Ubuntu package) - update to 9.5.19-0ubuntu0.16.04.1
postgresql-10 (Ubuntu package) - update to 10.10-0ubuntu0.18.04.1
postgresql-11 (Debian package) - update to 11.5-1+deb10u1
postgresql (Alpine package) - update to 11.5-r0
postgresql-11 (Ubuntu package) - update to 11.5-0ubuntu0.19.04.1
postgresql - addressed in versions 10.10-1.fc29, 11.5-1.fc30
libpq - update to 11.5-1.fc30

• https://www.postgresql.org/about/news/1960/

• Multiple vulnerabilities in PostgreSQL
• Ubuntu update for PostgreSQL
• Debian update for postgresql-11
• Arch Linux update for postgresql-libs
• Arch Linux update for postgresql
• OpenSUSE Linux update for SUSE Manager Client Tools
• Information disclosure in postgresql (Alpine package)
• Fedora 30 update for libpq, postgresql
• Fedora 29 update for postgresql