KLA11572 Multiple vulnerabilities in PostgreSQL

Multiple vulnerabilities were found in PostgreSQL. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. A vulnerability in PostgreSQL can be exploited via reading the most common values of certain columns to bypass security restrictions;
2. A vulnerability in PostgreSQL can be exploited via reading arbitrary data directory files to execute arbitrary code;
3. A vulnerability in PostgreSQL can be exploited via reading arbitrary bytes of server memory to obtain sensitive information;

Original advisories

PostgreSQL 11.3, 10.8, 9.6.13, 9.5.17, and 9.4.22 Released!

Related products

PostgreSQL

CVE list

CVE-2019-10130 warning

CVE-2019-10128 warning

CVE-2019-10127 warning

CVE-2019-10129 warning

Solution

Update to latest version

Download PostgreSQL

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• PostgreSQL 11.x earlier than 11.3PostgreSQL 10.x earlier than 10.8PostgreSQL 9.6.x earlier than 9.6.13PostgreSQL 9.5.x earlier than 9.5.17PostgreSQL 9.4.x earlier than 9.4.22