Stack-based buffer overflow in PostgreSQL
Priority MEDIUM 44CWE-121Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-121 and the CVSS impact.
Summary
PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.
Why it matters now
EPSS 0.03643 89th percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PostgreSQL | PostgreSQL | 10.9; 11.4 | — | No fix listed | CNA |
- PostgreSQL VendorPostgreSQL Affected 10.9; 11.4 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* | 10.0 to before 10.9; 11.0 to before 11.4 | Vulnerable | PostgreSQL |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* | 29 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
- cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions 10.0 to before 10.9; 11.0 to before 11.4 Vulnerable ·PostgreSQL
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
Remediation
Red Hat 4 advisories
- RHSA-2021:0166 Released 2021-01-18 · Red Hat rating Importantpostgresql:10 security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.1) postgresql-10.15-1.module+el8.1.0+9154+cd474635.aarch64::postgresql:10, postgresql-10.15-1.module+el8.1.0+9154+cd474635.ppc64le::postgresql:10, postgresql-10.15-1.module+el8.1.0+9154+cd474635.s390x::postgresql:10 +47
- RHSA-2020:5664 Released 2020-12-22 · Red Hat rating Importantpostgresql:10 security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.0) postgresql-10.15-1.module+el8.0.0+9155+4a85661a.ppc64le::postgresql:10, postgresql-10.15-1.module+el8.0.0+9155+4a85661a.src::postgresql:10, postgresql-10.15-1.module+el8.0.0+9155+4a85661a.x86_64::postgresql:10 +24
- RHSA-2020:3669 Released 2020-09-08 · Red Hat rating Moderatepostgresql:10 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) postgresql-10.14-1.module+el8.2.0+7801+be0fed80.aarch64::postgresql:10, postgresql-10.14-1.module+el8.2.0+7801+be0fed80.ppc64le::postgresql:10, postgresql-10.14-1.module+el8.2.0+7801+be0fed80.s390x::postgresql:10 +47
Show 1 more Red Hat advisories
- RHSA-2020:0980 Released 2020-03-26 · Red Hat rating Moderaterh-postgresql10-postgresql security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-postgresql10-postgresql-10.12-2.el7, rh-postgresql10-postgresql-contrib-10.12-2.el7, rh-postgresql10-postgresql-contrib-syspaths-10.12-2.el7 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-postgresql10-postgresql-10.12-2.el7, rh-postgresql10-postgresql-contrib-10.12-2.el7, rh-postgresql10-postgresql-contrib-syspaths-10.12-2.el7 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-postgresql10-postgresql-10.12-2.el7, rh-postgresql10-postgresql-contrib-10.12-2.el7, rh-postgresql10-postgresql-contrib-syspaths-10.12-2.el7 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-postgresql10-postgresql-10.12-2.el7, rh-postgresql10-postgresql-contrib-10.12-2.el7, rh-postgresql10-postgresql-contrib-syspaths-10.12-2.el7 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-postgresql10-postgresql-10.12-2.el7, rh-postgresql10-postgresql-contrib-10.12-2.el7, rh-postgresql10-postgresql-contrib-syspaths-10.12-2.el7 +11
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:3669 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.0) | Fixed | RHSA-2020:5664 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.1) | Fixed | RHSA-2021:0166 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:0980 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) | Fixed | RHSA-2020:0980 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2020:0980 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2020:0980 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:0980 |
Not affected: 11 products
- Red Hat Decision Manager 7
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Process Automation 7
- Red Hat Satellite 5
- Red Hat Satellite 6
- Red Hat Software Collections
- Red Hat Storage 3
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10164
- 2026-10-03 Alias added: GHSA-gr34-mv2c-wc84
References
More Postgresql vulnerabilities
- TI-2019-06651 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and… CVSS 3.0HIGH 7.2
- TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
- TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8
- TI-2013-01675 Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9… CVSS 2.0MEDIUM 6.5
- TI-2007-03176 The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE… CVSS 2.0HIGH 9.0
- TI-2022-01423 SQL injection in postgresql CVSS 3.1HIGH 8.8
Sources
- CVE-2019-10164 · CVE Program
- CVE-2019-10164 · NVD
- FIRST EPSS
- GHSA-gr34-mv2c-wc84 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-10164 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences