Vulnerability Description
A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Postgresql | Postgresql | >= 9.5.0, < 9.5.17 |
| Opensuse | Leap | 15.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.htmlMailing ListThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10130Issue TrackingThird Party Advisory
- https://security.gentoo.org/glsa/202003-03Third Party Advisory
- https://www.postgresql.org/about/news/1939/Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.htmlMailing ListThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10130Issue TrackingThird Party Advisory
- https://security.gentoo.org/glsa/202003-03Third Party Advisory
- https://www.postgresql.org/about/news/1939/Vendor Advisory
FAQ
What is CVE-2019-10130?
CVE-2019-10130 is a vulnerability with a CVSS score of 4.3 (MEDIUM). A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statist...
How severe is CVE-2019-10130?
CVE-2019-10130 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-10130?
Check the references section above for vendor advisories and patch information. Affected products include: Postgresql Postgresql, Opensuse Leap.