Vulnerability in packaging (CVE-2019-10210)

Windows installer writes superuser password to unprotected temporary file

The EnterpriseDB Windows installer writes a password to a temporary file in its installation directory, creates initial databases, and deletes the file. During those seconds while the file exists, a local attacker can read the PostgreSQL superuser password from the file.

The PostgreSQL project thanks Noah Misch for reporting this problem.