CVE-2019-10130: Medium severity postgresql vulnerability

Published May 6, 2019
·
Updated

A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.

Affected Software

11 affected componentsFixes available
redhat/rh-postgresql10-postgresql<0:10.12-2.el7
0:10.12-2.el7
redhat/rh-postgresql96-postgresql<0:9.6.19-1.el7
0:9.6.19-1.el7
redhat/postgresql<11.3
11.3
redhat/postgresql<10.8
10.8
redhat/postgresql<9.6.13
9.6.13
redhat/postgresql<9.5.17
9.5.17
PostgreSQL postgresql>=9.5.0<9.5.17
PostgreSQL postgresql>=9.6.0<9.6.13
PostgreSQL postgresql>=10.0<10.8
PostgreSQL postgresql>=11.0<11.3
openSUSE Leap=15.1

Event History

May 9, 2019
CVE Published
12:00 AM
Jul 30, 2019
CVE Published
via MITRE·04:13 PM
Data Sourced
via MITRE·04:13 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What is the severity of CVE-2019-10130?

The severity of CVE-2019-10130 is medium with a severity value of 4.3.

2

Which versions of PostgreSQL are affected by CVE-2019-10130?

PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17 are affected by CVE-2019-10130.

3

What does PostgreSQL maintain for tables?

PostgreSQL maintains column statistics for tables.

4

What statistics does PostgreSQL maintain for tables?

PostgreSQL maintains certain statistics such as histograms and lists of most common values for tables.

5

Where can I find more information about CVE-2019-10130?

You can find more information about CVE-2019-10130 at the following references: [Reference 1](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1709193), [Reference 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1709192), [Reference 3](https://www.postgresql.org/about/news/1939/).

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203