CVE-2019-10209 - postgresql: Memory disclosure in cross-type comparison for hashed subplan

LOW

postgresql: Memory disclosure in cross-type comparison for hashed subplan

Published Oct 29, 2019

2.2

LOW

CVSS 3.1

EPSS 1.08%

Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
all 11.x before 11.5	affected	-

Product	Package	State	Advisory
Red Hat Decision Manager 7	postgresql	Not affected	n/a
Red Hat Enterprise Linux 5	postgresql	Not affected	n/a
Red Hat Enterprise Linux 6	postgresql	Not affected	n/a
Red Hat Enterprise Linux 7	postgresql	Not affected	n/a
Red Hat Enterprise Linux 8	libpq	Not affected	n/a
Red Hat Enterprise Linux 8	postgresql:10/postgresql	Not affected	n/a
Red Hat Enterprise Linux 8	postgresql:9.6/postgresql	Not affected	n/a
Red Hat Process Automation 7	postgresql	Not affected	n/a
Red Hat Satellite 5	rh-postgresql95-postgresql	Not affected	n/a
Red Hat Software Collections	rh-postgresql10-postgresql	Not affected	n/a
Red Hat Software Collections	rh-postgresql96-postgresql	Not affected	n/a
Red Hat Storage 3	rhevm-dependencies	Not affected	n/a
Red Hat Virtualization 4	rh-postgresql10	Not affected	n/a
Red Hat Virtualization 4	rh-postgresql10-postgresql	Not affected	n/a
Red Hat Virtualization 4	rh-postgresql95	Not affected	n/a
Red Hat Virtualization 4	rh-postgresql95-postgresql	Not affected	n/a

No remediation recorded yet.

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-200

Exposure of Sensitive Information

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-10209		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1734447		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10209		x_refsource_CONFIRMIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10209
https://www.cve.org/CVERecord?id=CVE-2019-10209
https://www.postgresql.org/about/news/1960/		x_refsource_CONFIRMVendor Advisory