CVE-2019-10208: A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x befor

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• postgresql postgresql9.4.0 and later · before 9.4.24
• postgresql postgresql9.5.0 and later · before 9.5.19
• postgresql postgresql9.6.0 and later · before 9.6.15
• postgresql postgresql10.0 and later · before 10.10
• postgresql postgresql11.0 and later · before 11.5

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• PostgreSQL postgresql

  • all 11.x before 11.5, all 10.x before 10.10, all 9.6.x before 9.6.15, all 9.5.x before 9.5.19, all 9.4.x before 9.4.24affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2017-7546PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers
  57Plan
• CVE-2019-9193In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to
  55Plan
• CVE-2020-25695A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24.
  49Plan

Published before and after this one in the same product

• ← EarlierCVE-2019-10129Jul 30, 2019 · A vulnerability was found in postgresql versions 11.x prior to 11.3.
  26Monitor
• ← EarlierCVE-2019-10130Jul 30, 2019 · A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x
  17Monitor
• Later →CVE-2019-10209Oct 29, 2019 · Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.
  8Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The query text is built by concatenating user input. The database cannot tell where the data ends and the command begins.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = '" + owner + "'"4);

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = $1",4  [owner]5);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.