{ "id": "CVE-2019-10208", "sourceIdentifier": "secalert@redhat.com", "published": "2019-10-29T19:15:16.127", "lastModified": "2024-11-21T04:18:39.480", "vulnStatus": "Modified", "cveTags": [], "descriptions": [ { "lang": "en", "value": "A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function." }, { "lang": "es", "value": "Se descubri\u00f3 un fallo en postgresql versiones 9.4.x en versiones anteriores a la 9.4.24, versiones 9.5.x en versiones anteriores a la 9.5.19, versiones 9.6.x en versiones anteriores a la 9.6.15, versiones 10.x en versiones anteriores a la 10.10 y versiones 11.x en versiones anteriores a la 11.5 donde pueden ser ejecutadas sentencias SQL arbitrarias dada una funci\u00f3n SECURITY DEFINER adecuada. Un atacante, con permiso EXECUTE sobre la funci\u00f3n, puede ejecutar c\u00f3digo SQL arbitrario como propietario de la funci\u00f3n." } ], "metrics": { "cvssMetricV31": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" }, "exploitabilityScore": 2.8, "impactScore": 5.9 } ], "cvssMetricV30": [ { "source": "secalert@redhat.com", "type": "Secondary", "cvssData": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" }, "exploitabilityScore": 1.6, "impactScore": 5.9 } ], "cvssMetricV2": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "baseScore": 6.5, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL" }, "baseSeverity": "MEDIUM", "exploitabilityScore": 8.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false } ] }, "weaknesses": [ { "source": "secalert@redhat.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-89" } ] }, { "source": "nvd@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-89" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.4.0", "versionEndExcluding": "9.4.24", "matchCriteriaId": "59A70E18-2AA4-4E44-9C30-736121661BFC" }, { "vulnerable": true, "criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.5.0", "versionEndExcluding": "9.5.19", "matchCriteriaId": "F17B1734-0D92-4434-9F41-069AE7AE6EFE" }, { "vulnerable": true, "criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.6.0", "versionEndExcluding": "9.6.15", "matchCriteriaId": "52AAE645-3756-47F8-8A58-29444E39F963" }, { "vulnerable": true, "criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0", "versionEndExcluding": "10.10", "matchCriteriaId": "844BDD2B-4EBC-4F1D-ABE7-5D8ED01F519B" }, { "vulnerable": true, "criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0", "versionEndExcluding": "11.5", "matchCriteriaId": "5D4F2F01-FAA1-418D-8FD7-CAABA183BB19" } ] } ] } ], "references": [ { "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html", "source": "secalert@redhat.com" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10208", "source": "secalert@redhat.com", "tags": [ "Issue Tracking", "Third Party Advisory" ] }, { "url": "https://www.postgresql.org/about/news/1960/", "source": "secalert@redhat.com", "tags": [ "Vendor Advisory" ] }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html", "source": "af854a3a-2127-422b-91ae-364da2661108" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10208", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Issue Tracking", "Third Party Advisory" ] }, { "url": "https://www.postgresql.org/about/news/1960/", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Vendor Advisory" ] } ] }