CVE-2019-10129 Information disclosure in postgresql

What is CVE-2019-10129?

CVE-2019-10129 is a medium-severity vulnerability in Postgresql Postgresql, published on 30 Jul 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any user can create a partitioned table suitable for this attack. (Exploit prerequisites are the same as for CVE-2018-1052).

Weakness: CWE-125

Which versions are affected by CVE-2019-10129?

It affects 1 product.

Products include Postgresql Postgresql.

How do I fix CVE-2019-10129?

Upgrade to a fixed version.

Is CVE-2019-10129 being exploited?

There is no known exploitation of CVE-2019-10129 in the wild and no public exploit code.

Other vulnerabilities in Postgresql Postgresql

• CVE-2013-1902 Information disclosure in n/a Critical 10.0
• CVE-2013-1903 Information disclosure in n/a Critical 10.0
• CVE-2007-3279 Privilege escalation in n/a Critical 10.0
• CVE-2002-1399 Integer overflow in n/a Critical 10.0
• CVE-2016-3065 Information disclosure in n/a Critical 9.1

All Postgresql Postgresql vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2019-10129, CLEANSTART-2026-WC72049, GHSA-8f7w-x9j5-q7c8.