PostgreSQL Vulnerability: Exposure of Column Statistics Due to Row Security Policy Bypass
Summary
ALPINE-CVE-2019-10130: A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. Affects postgresql versions < 11.3-r0. Fixed in 11.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source relational database management system that uses and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types. However, certain versions of PostgreSQL are vulnerable to a security issue that allows attackers to access sensitive column statistics, potentially leading to data exposure.
Vulnerability Detail
A vulnerability exists in PostgreSQL versions 11.x (up to but not including 11.3), 10.x (up to but not including 10.8), 9.6.x (up to but not including 9.6.13), and 9.5.x (up to but not including 9.5.17). The issue arises because PostgreSQL does not evaluate row security policies before consulting column statistics during query planning. This oversight allows an attacker with SELECT privilege on certain columns to exploit the vulnerability and read the most common values of those columns, even when row-level security would ordinarily restrict access to the data.
How To Fix
Minimum fixed version
11.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling row-level security for the affected tables until the package can be updated. This can be done with the following SQL command: 'ALTER TABLE <table_name> DISABLE ROW LEVEL SECURITY;' Replace <table_name> with the name of your table.
Conclusion
In summary, PostgreSQL has a vulnerability that allows attackers to access sensitive column statistics due to a failure to enforce row security policies. It is crucial to update to the patched versions to mitigate this risk. Additionally, users can utilize Vulert to monitor their applications for vulnerabilities in real-time.
See every vulnerability recorded for postgresql →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a medium severity level.
Affected versions include PostgreSQL 11.x (up to but not including 11.3), 10.x (up to but not including 10.8), 9.6.x (up to but not including 9.6.13), and 9.5.x (up to but not including 9.5.17).
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
An attacker could exploit this vulnerability to access sensitive column statistics, which may lead to unauthorized data exposure.
Yes, you can temporarily disable row-level security on affected tables as a workaround until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
