CVE-2019-10208

NameCVE-2019-10208
DescriptionA flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1874-1, DSA-4492-1, DSA-4493-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
postgresql-11 (PTS)buster11.9-0+deb10u1fixed
buster (security)11.7-0+deb10u1fixed
postgresql-9.6 (PTS)stretch9.6.17-0+deb9u1fixed
stretch (security)9.6.19-0+deb9u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
postgresql-11sourcebuster11.5-1+deb10u1DSA-4493-1
postgresql-11source(unstable)11.5-1
postgresql-9.4sourcejessie9.4.24-0+deb8u1DLA-1874-1
postgresql-9.4source(unstable)(unfixed)
postgresql-9.6sourcestretch9.6.15-0+deb9u1DSA-4492-1
postgresql-9.6source(unstable)(unfixed)

Notes

https://www.postgresql.org/about/news/1960/

Search for package or bug name: Reporting problems