CVE-2019-10208

NameCVE-2019-10208
DescriptionA flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1874-1, DSA-4492-1, DSA-4493-1

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
postgresql-11sourcebuster11.5-1+deb10u1DSA-4493-1
postgresql-11source(unstable)11.5-1
postgresql-9.4sourcejessie9.4.24-0+deb8u1DLA-1874-1
postgresql-9.4source(unstable)(unfixed)
postgresql-9.6sourcestretch9.6.15-0+deb9u1DSA-4492-1
postgresql-9.6source(unstable)(unfixed)

Notes

https://www.postgresql.org/about/news/1960/

Search for package or bug name: Reporting problems