CVE-2019-10128
First published: Mon May 06 2019(Updated: )
A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, this allows a local attacker to read arbitrary data directory files, essentially bypassing database-imposed read access limitations. In plausible non-default configurations, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PostgreSQL PostgreSQL | <9.4.22 | |
| PostgreSQL PostgreSQL | >=9.5.0<9.5.17 | |
| PostgreSQL PostgreSQL | >=9.6.0<9.6.13 | |
| PostgreSQL PostgreSQL | >=10.0<10.8 | |
| PostgreSQL PostgreSQL | >=11.0<11.3 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this PostgreSQL vulnerability?
The vulnerability ID is CVE-2019-10128.
What is the severity of CVE-2019-10128?
The severity of CVE-2019-10128 is high with a CVSS score of 7.8.
Which versions of PostgreSQL are affected by CVE-2019-10128?
Versions 11.x prior to 11.3 are affected.
How does the vulnerability in PostgreSQL impact Windows installations?
The vulnerability in PostgreSQL allows an attacker to bypass ACL restrictions on the binary installation directory and data directory in Windows installations.
Is Microsoft Windows vulnerable to CVE-2019-10128?
No, Microsoft Windows is not vulnerable to CVE-2019-10128.
- collector/redhat-bugzilla
- alias/CVE-2019-10128
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/type
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/postgresql
- canonical/postgresql postgresql
- version/postgresql postgresql/9.5.0
- version/postgresql postgresql/9.6.0
- version/postgresql postgresql/10.0
- version/postgresql postgresql/11.0
- vendor/microsoft
- canonical/microsoft windows