Homepage

Improper Access Control The advisory has been revoked - it doesn't affect any version of package libpq5-32bit  (opens in a new tab)

Threat Intelligence

EPSS
0.3% (70th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Access Control vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-SLES150-LIBPQ532BIT-2742094
  • published14 Apr 2022
  • disclosed10 Jul 2019
Report a new vulnerability Found a mistake?

Introduced: 10 Jul 2019

CVE-2019-10130  (opens in a new tab)
CWE-284  (opens in a new tab)

Amendment

The SLES security team deemed this advisory irrelevant for SLES:15.0.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libpq5-32bit package and not the libpq5-32bit package as distributed by SLES.

A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.