Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.

New upstream release 11.5

Per release notes:
https://www.postgresql.org/docs/11/release-11-5.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream release 10.10

Per release notes:
https://www.postgresql.org/docs/11/release-10-10.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of PostgreSQL installed on the remote host is 11.x prior to 11.5. It is, therefore, affected by a memory disclosure vulnerability that allows an attacker to read arbitrary bytes of server memory.

Tom Lane discovered that PostgreSQL did not properly restrict functions declared as 'SECURITY DEFINER'. An attacker could use this to execute arbitrary SQL with the permissions of the function owner.
(CVE-2019-10208)

Andreas Seltenreich discovered that PostgreSQL did not properly handle user-defined hash equality operators. An attacker could use this to expose sensitive information (arbitrary PostgreSQL server memory).
This issue only affected Ubuntu 19.04. (CVE-2019-10209).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The PostgreSQL project reports :

Versions Affected: 9.4 - 11

Given a suitable `SECURITY DEFINER` function, an attacker can execute arbitrary SQL under the identity of the function owner. An attack requires `EXECUTE` permission on the function, which must itself contain a function call having inexact argument type match. For example, `length('foo'::varchar)` and `length('foo')` are inexact, while `length('foo'::text)` is exact. As part of exploiting this vulnerability, the attacker uses `CREATE DOMAIN` to create a type in a `pg_temp` schema. The attack pattern and fix are similar to that for CVE-2007-2138.

Writing `SECURITY DEFINER` functions continues to require following the considerations noted in the documentation :

https://www.postgresql.org/docs/devel/sql-createfunction.html#SQL-CREA TEFUNCTION-SECURITY

Versions Affected: 11

In a database containing hypothetical, user-defined hash equality operators, an attacker could read arbitrary bytes of server memory.
For an attack to become possible, a superuser would need to create unusual operators. It is possible for operators not purpose-crafted for attack to have the properties that enable an attack, but we are not aware of specific examples.

Two security issues have been discovered in the PostgreSQL database system, which could result in privilege escalation, denial of service or memory disclosure.

For additional information please refer to the upstream announcement at https://www.postgresql.org/about/news/1960/

ID	Name	Product	Family	Severity
127939	Fedora 30 : libpq / postgresql (2019-986fce48b4)	Nessus	Fedora Local Security Checks	critical
127934	Fedora 29 : postgresql (2019-5fbbf73269)	Nessus	Fedora Local Security Checks	critical
127906	PostgreSQL 11.x < 11.5 Memory disclosure in cross-type comparison for hashed subplan	Nessus	Databases	low
127806	Ubuntu 16.04 LTS / 18.04 LTS : PostgreSQL vulnerabilities (USN-4090-1)	Nessus	Ubuntu Local Security Checks	high
127549	FreeBSD : PostgresSQL -- TYPE in pg_temp execute arbitrary SQL during `SECURITY DEFINER` execution (9de4c1c1-b9ee-11e9-82aa-6cc21735f730)	Nessus	FreeBSD Local Security Checks	high
127489	Debian DSA-4493-1 : postgresql-11 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-10209

low

Tenable Plugins

critical

critical

low

high

high

high