Arbitrary SQL Execution Vulnerability in PostgreSQL - CVE-2019-10208
Summary
ALPINE-CVE-2019-10208: A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY... Affects postgresql versions < 11.5-r0. Fixed in 11.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database system that uses and extends the SQL language. It is known for its reliability, robustness, and performance. However, certain versions of PostgreSQL are vulnerable to a flaw that allows arbitrary SQL statements to be executed through SECURITY DEFINER functions, posing a significant security risk.
Vulnerability Detail
A flaw was discovered in PostgreSQL versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10, and 11.x before 11.5. This vulnerability allows an attacker with EXECUTE permission on a SECURITY DEFINER function to execute arbitrary SQL as the owner of that function. The potential ramifications include unauthorized data access, data manipulation, and overall compromise of the database integrity.
How To Fix
Minimum fixed version
11.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting EXECUTE permissions on SECURITY DEFINER functions until the package can be updated. This can be done by revoking permissions from untrusted users.
Conclusion
CVE-2019-10208 presents a significant security risk for various versions of PostgreSQL, allowing attackers to execute arbitrary SQL commands. It is crucial for users to update their PostgreSQL installations to the patched versions to mitigate this vulnerability and protect their data integrity.
See every vulnerability recorded for postgresql →
FAQ
CVE-2019-10208 is a vulnerability in PostgreSQL that allows arbitrary SQL execution through SECURITY DEFINER functions.
Affected versions include PostgreSQL 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10, and 11.x before 11.5.
The risks include unauthorized access to sensitive data, data manipulation, and the potential for a complete compromise of the database.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2019-10208 is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
