Read the docs
TI-2019-07453 Aliases CVE-2019-10130GHSA-5rxr-v694-cxfj

Improper access control in postgresql

Priority LOW 22CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 9 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-284.

Summary

A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.

Why it matters now

EPSS 0.01085 65th percentileScored 2026-11-07
Fix Partial Red Hat: 9 advisoriesRed Hat: 9 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PostgreSQLpostgresql11.x up to, excluding 11.3; 10.x up to, excluding 10.8; 9.6.x up to, excluding 9.6.13; 9.5.x up to, excluding 9.5.17—No fix listedCNA
  • postgresql VendorPostgreSQL Affected 11.x up to, excluding 11.3; 10.x up to, excluding 10.8; 9.6.x up to, excluding 9.6.13; 9.5.x up to, excluding 9.5.17 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*9.5.0 to before 9.5.17; 9.6.0 to before 9.6.13; 10.0 to before 10.8; 11.0 to before 11.3VulnerablePostgreSQL
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions 9.5.0 to before 9.5.17; 9.6.0 to before 9.6.13; 10.0 to before 10.8; 11.0 to before 11.3 Vulnerable ·PostgreSQL
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE

Remediation

Red Hat 9 advisories

  • RHSA-2021:0167 Released 2021-01-18 · Red Hat rating Important
    postgresql:9.6 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.1) postgresql-9.6.20-1.module+el8.1.0+9156+8ff1384f.aarch64::postgresql:9.6, postgresql-9.6.20-1.module+el8.1.0+9156+8ff1384f.ppc64le::postgresql:9.6, postgresql-9.6.20-1.module+el8.1.0+9156+8ff1384f.s390x::postgresql:9.6 +42
  • RHSA-2021:0166 Released 2021-01-18 · Red Hat rating Important
    postgresql:10 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.1) postgresql-10.15-1.module+el8.1.0+9154+cd474635.aarch64::postgresql:10, postgresql-10.15-1.module+el8.1.0+9154+cd474635.ppc64le::postgresql:10, postgresql-10.15-1.module+el8.1.0+9154+cd474635.s390x::postgresql:10 +47
  • RHSA-2021:0164 Released 2021-01-18 · Red Hat rating Important
    postgresql:9.6 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) postgresql-9.6.20-1.module+el8.2.0+8939+9a3b4b64.aarch64::postgresql:9.6, postgresql-9.6.20-1.module+el8.2.0+8939+9a3b4b64.ppc64le::postgresql:9.6, postgresql-9.6.20-1.module+el8.2.0+8939+9a3b4b64.s390x::postgresql:9.6 +42
Show 6 more Red Hat advisories
  • RHSA-2020:5664 Released 2020-12-22 · Red Hat rating Important
    postgresql:10 security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.0) postgresql-10.15-1.module+el8.0.0+9155+4a85661a.ppc64le::postgresql:10, postgresql-10.15-1.module+el8.0.0+9155+4a85661a.src::postgresql:10, postgresql-10.15-1.module+el8.0.0+9155+4a85661a.x86_64::postgresql:10 +24
  • RHSA-2020:5661 Released 2020-12-22 · Red Hat rating Important
    postgresql:9.6 security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.0) postgresql-9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le::postgresql:9.6, postgresql-9.6.20-1.module+el8.0.0+9157+356b8def.src::postgresql:9.6, postgresql-9.6.20-1.module+el8.0.0+9157+356b8def.x86_64::postgresql:9.6 +20
  • RHSA-2020:5619 Released 2020-12-17 · Red Hat rating Important
    postgresql:9.6 security update
    • Red Hat Enterprise Linux AppStream (v. 8) postgresql-9.6.20-1.module+el8.3.0+8938+7f0e88b6.aarch64::postgresql:9.6, postgresql-9.6.20-1.module+el8.3.0+8938+7f0e88b6.ppc64le::postgresql:9.6, postgresql-9.6.20-1.module+el8.3.0+8938+7f0e88b6.s390x::postgresql:9.6 +42
  • RHSA-2020:4295 Released 2020-10-21 · Red Hat rating Moderate
    rh-postgresql96-postgresql security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-postgresql96-postgresql-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.19-1.el7 +11
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-postgresql96-postgresql-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.19-1.el7 +11
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-postgresql96-postgresql-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.19-1.el7 +11
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-postgresql96-postgresql-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.19-1.el7 +11
  • RHSA-2020:3669 Released 2020-09-08 · Red Hat rating Moderate
    postgresql:10 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) postgresql-10.14-1.module+el8.2.0+7801+be0fed80.aarch64::postgresql:10, postgresql-10.14-1.module+el8.2.0+7801+be0fed80.ppc64le::postgresql:10, postgresql-10.14-1.module+el8.2.0+7801+be0fed80.s390x::postgresql:10 +47
  • RHSA-2020:0980 Released 2020-03-26 · Red Hat rating Moderate
    rh-postgresql10-postgresql security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-postgresql10-postgresql-10.12-2.el7, rh-postgresql10-postgresql-contrib-10.12-2.el7, rh-postgresql10-postgresql-contrib-syspaths-10.12-2.el7 +11
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-postgresql10-postgresql-10.12-2.el7, rh-postgresql10-postgresql-contrib-10.12-2.el7, rh-postgresql10-postgresql-contrib-syspaths-10.12-2.el7 +11
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-postgresql10-postgresql-10.12-2.el7, rh-postgresql10-postgresql-contrib-10.12-2.el7, rh-postgresql10-postgresql-contrib-syspaths-10.12-2.el7 +11
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-postgresql10-postgresql-10.12-2.el7, rh-postgresql10-postgresql-contrib-10.12-2.el7, rh-postgresql10-postgresql-contrib-syspaths-10.12-2.el7 +11
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-postgresql10-postgresql-10.12-2.el7, rh-postgresql10-postgresql-contrib-10.12-2.el7, rh-postgresql10-postgresql-contrib-syspaths-10.12-2.el7 +11

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Software CollectionsAffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:3669, RHSA-2020:5619
Red Hat Enterprise Linux AppStream E4S (v. 8.0)Fixed RHSA-2020:5661, RHSA-2020:5664
Red Hat Enterprise Linux AppStream EUS (v. 8.1)Fixed RHSA-2021:0166, RHSA-2021:0167
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2021:0164
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:0980, RHSA-2020:4295
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2020:0980
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2020:0980, RHSA-2020:4295
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2020:0980, RHSA-2020:4295
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:0980, RHSA-2020:4295
Not affected: 8 products
  • CloudForms Management Engine 5
  • Red Hat Ansible Tower 3
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Satellite 5
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10130
  2. 2026-10-03 Alias added: GHSA-5rxr-v694-cxfj

References

Advisory 4

  • TI-2019-06651 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and… CVSS 3.0HIGH 7.2
  • TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
  • TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8
  • TI-2013-01675 Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9… CVSS 2.0MEDIUM 6.5
  • TI-2007-03176 The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE… CVSS 2.0HIGH 9.0
  • TI-2022-01423 SQL injection in postgresql CVSS 3.1HIGH 8.8
See all 202 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences