CVE-2019-10209
In a database containing hypothetical, user-defined hash equality operators, an attacker could read arbitrary bytes of server memory. For an attack to become possible, a superuser would need to create unusual operators. It is possible for operators not purpose-crafted for attack to have the properties that enable an attack, but we are not aware of specific examples.
The PostgreSQL project thanks Andreas Seltenreich for reporting this problem.
Version Information
| Affected branch | Introduced | Fixed In | Fix Published |
|---|
| 11 | — | 11.5 | 2019-08-08 |
CVSS 3.0
| Overall Score | 3.1 |
|---|
| Component | core server |
|---|
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
|---|
First published: 2019-08-08
Original security advisory · JSON · All advisories