Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
Related vulnerabilities
USN-3972-1 (UBUNTU-CVE-2019-10129)
Vulnerability from osv_ubuntu – Published: 2019-05-13 12:03 – Updated: 2026-04-22 07:36 – Source website
VLAI
Summary
postgresql-10, postgresql-11, postgresql-9.5 vulnerabilities
Details
It was discovered that PostgreSQL incorrectly handled partition routing. A remote user could possibly use this issue to read arbitrary bytes of server memory. This issue only affected Ubuntu 19.04. (CVE-2019-10129)
Dean Rasheed discovered that PostgreSQL incorrectly handled selectivity estimators. A remote attacker could possibly use this issue to bypass row security policies. (CVE-2019-10130)
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2019-10130",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:16.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "libecpg-compat3",
"binary_version": "9.5.17-0ubuntu0.16.04.1"
},
{
"binary_name": "libecpg6",
"binary_version": "9.5.17-0ubuntu0.16.04.1"
},
{
"binary_name": "libpgtypes3",
"binary_version": "9.5.17-0ubuntu0.16.04.1"
},
{
"binary_name": "libpq5",
"binary_version": "9.5.17-0ubuntu0.16.04.1"
},
{
"binary_name": "postgresql-9.5",
"binary_version": "9.5.17-0ubuntu0.16.04.1"
},
{
"binary_name": "postgresql-client-9.5",
"binary_version": "9.5.17-0ubuntu0.16.04.1"
},
{
"binary_name": "postgresql-contrib-9.5",
"binary_version": "9.5.17-0ubuntu0.16.04.1"
},
{
"binary_name": "postgresql-doc-9.5",
"binary_version": "9.5.17-0ubuntu0.16.04.1"
},
{
"binary_name": "postgresql-plperl-9.5",
"binary_version": "9.5.17-0ubuntu0.16.04.1"
},
{
"binary_name": "postgresql-plpython-9.5",
"binary_version": "9.5.17-0ubuntu0.16.04.1"
},
{
"binary_name": "postgresql-plpython3-9.5",
"binary_version": "9.5.17-0ubuntu0.16.04.1"
},
{
"binary_name": "postgresql-pltcl-9.5",
"binary_version": "9.5.17-0ubuntu0.16.04.1"
},
{
"binary_name": "postgresql-server-dev-9.5",
"binary_version": "9.5.17-0ubuntu0.16.04.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:16.04:LTS",
"name": "postgresql-9.5",
"purl": "pkg:deb/ubuntu/postgresql-9.5@9.5.17-0ubuntu0.16.04.1?arch=source\u0026distro=xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.5.17-0ubuntu0.16.04.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"9.5.0-1",
"9.5.0-2",
"9.5.0-3",
"9.5.1-1",
"9.5.2-1",
"9.5.3-0ubuntu0.16.04",
"9.5.4-0ubuntu0.16.04",
"9.5.5-0ubuntu0.16.04",
"9.5.6-0ubuntu0.16.04",
"9.5.7-0ubuntu0.16.04",
"9.5.8-0ubuntu0.16.04.1",
"9.5.9-0ubuntu0.16.04",
"9.5.10-0ubuntu0.16.04",
"9.5.11-0ubuntu0.16.04",
"9.5.12-0ubuntu0.16.04",
"9.5.13-0ubuntu0.16.04",
"9.5.14-0ubuntu0.16.04",
"9.5.16-0ubuntu0.16.04.1"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2019-10130",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:18.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "libecpg-compat3",
"binary_version": "10.8-0ubuntu0.18.04.1"
},
{
"binary_name": "libecpg6",
"binary_version": "10.8-0ubuntu0.18.04.1"
},
{
"binary_name": "libpgtypes3",
"binary_version": "10.8-0ubuntu0.18.04.1"
},
{
"binary_name": "libpq5",
"binary_version": "10.8-0ubuntu0.18.04.1"
},
{
"binary_name": "postgresql-10",
"binary_version": "10.8-0ubuntu0.18.04.1"
},
{
"binary_name": "postgresql-client-10",
"binary_version": "10.8-0ubuntu0.18.04.1"
},
{
"binary_name": "postgresql-doc-10",
"binary_version": "10.8-0ubuntu0.18.04.1"
},
{
"binary_name": "postgresql-plperl-10",
"binary_version": "10.8-0ubuntu0.18.04.1"
},
{
"binary_name": "postgresql-plpython-10",
"binary_version": "10.8-0ubuntu0.18.04.1"
},
{
"binary_name": "postgresql-plpython3-10",
"binary_version": "10.8-0ubuntu0.18.04.1"
},
{
"binary_name": "postgresql-pltcl-10",
"binary_version": "10.8-0ubuntu0.18.04.1"
},
{
"binary_name": "postgresql-server-dev-10",
"binary_version": "10.8-0ubuntu0.18.04.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "postgresql-10",
"purl": "pkg:deb/ubuntu/postgresql-10@10.8-0ubuntu0.18.04.1?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.8-0ubuntu0.18.04.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.1-1",
"10.1-2",
"10.2-1",
"10.3-1",
"10.4-0ubuntu0.18.04",
"10.5-0ubuntu0.18.04",
"10.6-0ubuntu0.18.04.1",
"10.7-0ubuntu0.18.04.1"
]
}
],
"aliases": [],
"details": "It was discovered that PostgreSQL incorrectly handled partition routing. A\nremote user could possibly use this issue to read arbitrary bytes of server\nmemory. This issue only affected Ubuntu 19.04. (CVE-2019-10129)\n\nDean Rasheed discovered that PostgreSQL incorrectly handled selectivity\nestimators. A remote attacker could possibly use this issue to bypass row\nsecurity policies. (CVE-2019-10130)\n",
"id": "USN-3972-1",
"modified": "2026-04-22T07:36:37Z",
"published": "2019-05-13T12:03:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-3972-1"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2019-10129"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2019-10130"
}
],
"related": [],
"schema_version": "1.7.0",
"summary": "postgresql-10, postgresql-11, postgresql-9.5 vulnerabilities",
"upstream": [
"UBUNTU-CVE-2019-10129",
"UBUNTU-CVE-2019-10130"
]
}