Improper access control in postgresql
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, this allows a local attacker to read arbitrary data directory files, essentially bypassing database-imposed read access limitations. In plausible non-default configurations, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | postgresql | 11 to before 11.3 | 11.3 | Patch available | CNA |
- postgresql Vendor— Affected 11 to before 11.3 Fixed in 11.3 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* | before 9.4.22; 9.5.0 to before 9.5.17; 9.6.0 to before 9.6.13; 10.0 to before 10.8; 11.0 to before 11.3 | Vulnerable | PostgreSQL |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions before 9.4.22; 9.5.0 to before 9.5.17; 9.6.0 to before 9.6.13; 10.0 to before 10.8; 11.0 to before 11.3 Vulnerable ·PostgreSQL
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA postgresql Fixed in 11.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 10 products
- CloudForms Management Engine 5
- Red Hat Ansible Tower 3
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Satellite 5
- Red Hat Satellite 6
- Red Hat Software Collections
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10128
- 2026-10-03 Alias added: GHSA-6434-33f9-3qqj
References
More Postgresql vulnerabilities
- TI-2019-06651 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and… CVSS 3.0HIGH 7.2
- TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
- TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8
- TI-2013-01675 Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9… CVSS 2.0MEDIUM 6.5
- TI-2007-03176 The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE… CVSS 2.0HIGH 9.0
- TI-2022-01423 SQL injection in postgresql CVSS 3.1HIGH 8.8
Sources
- CVE-2019-10128 · CVE Program
- CVE-2019-10128 · NVD
- FIRST EPSS
- GHSA-6434-33f9-3qqj · GitHub Advisory Database · CC BY 4.0
- CVE-2019-10128 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences