CVE-2019-10208

Publication date 8 August 2019

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.

From the Ubuntu Security Team

Tom Lane discovered that PostgreSQL did not properly restrict functions declared as "SECURITY DEFINER". An attacker could use this to execute arbitrary SQL with the permissions of the function owner.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
postgresql-10	19.10 eoan	Not in release
	19.04 disco	Not in release
	18.04 LTS bionic	Fixed 10.10-0ubuntu0.18.04.1
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
postgresql-11	19.10 eoan	Fixed 11.5-1
	19.04 disco	Fixed 11.5-0ubuntu0.19.04.1
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
postgresql-9.1	19.10 eoan	Not in release
	19.04 disco	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
postgresql-9.3	19.10 eoan	Not in release
	19.04 disco	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Ignored
postgresql-9.5	19.10 eoan	Not in release
	19.04 disco	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Fixed 9.5.19-0ubuntu0.16.04.1
	14.04 LTS trusty	Not in release

Notes

leosilva

since 9.3 is not supported anymore by upstream and for now we don't have how to patch it I'm marking it as ignored.

Severity score breakdown

Parameter	Value
Base score	8.8 · High
Attack vector	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

USN-4090-1
PostgreSQL vulnerabilities
9 August 2019