CVE-2019-10211

Published: Oct 29, 2019Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory.

Affected (5)

Products: Postgresql: Postgresql

1 product

Configuration A

5 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Postgresql Postgresql	Before 9.4.24
Postgresql Postgresql	From 10.0 to 10.10
Postgresql Postgresql	From 11.0 to 11.5
Postgresql Postgresql	From 9.5.0 to 9.5.19
Postgresql Postgresql	From 9.6.0 to 9.6.15

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (4)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10211

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://www.postgresql.org/about/news/1960/

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10211

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://www.postgresql.org/about/news/1960/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.