A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.

CPENameOperatorVersion
postgresqlge9.5.0
postgresqllt9.5.19
postgresqlge9.6.0
postgresqllt9.6.15
postgresqlge10.0
postgresqllt10.10
postgresqlge11.0
postgresqllt11.5
postgresqlge9.4.0
postgresqllt9.4.24

Name	Operator	Version
postgresql	ge	9.5.0
postgresql	lt	9.5.19
postgresql	ge	9.6.0
postgresql	lt	9.6.15
postgresql	ge	10.0
postgresql	lt	10.10
postgresql	ge	11.0
postgresql	lt	11.5
postgresql	ge	9.4.0
postgresql	lt	9.4.24