Memory Disclosure Vulnerability in PostgreSQL: CVE-2019-10129
Summary
ALPINE-CVE-2019-10129: A vulnerability was found in postgresql versions 11.x prior to 11.3. Affects postgresql versions < 11.3-r0. Fixed in 11.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database system known for its robustness, extensibility, and SQL compliance. It supports various data types and offers advanced features such as transactions, concurrency, and partitioning. However, versions prior to 11.3 are vulnerable to a memory disclosure issue that can be exploited by attackers through crafted insert operations on partitioned tables.
Vulnerability Detail
A vulnerability was found in PostgreSQL versions 11.x prior to 11.3. An attacker can exploit this vulnerability by using a specially crafted insert to a partitioned table, allowing them to read arbitrary bytes of server memory. This poses a significant risk as it can lead to unauthorized access to sensitive data stored in memory. The exploit prerequisites are similar to those for CVE-2018-1052, making it critical for users to understand the implications of this vulnerability.
How To Fix
Minimum fixed version
11.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict user permissions to prevent unauthorized users from creating partitioned tables. This can be done by reviewing and modifying user roles and privileges within the PostgreSQL database.
Conclusion
CVE-2019-10129 represents a significant memory disclosure vulnerability in PostgreSQL versions prior to 11.3. Users are strongly advised to update to the latest version to protect against potential exploitation. Implementing user permission restrictions can serve as a temporary measure until the update is applied.
See every vulnerability recorded for postgresql →
FAQ
CVE-2019-10129 is a vulnerability in PostgreSQL that allows attackers to read arbitrary bytes of server memory through crafted inserts to partitioned tables.
PostgreSQL versions 11.x prior to 11.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2019-10129 is 6.5, indicating a medium severity level.
If immediate updates are not possible, consider implementing user permission restrictions as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
