{"id":"CVE-2019-10209","aliases":["ALPINE-CVE-2019-10209","BELL-CVE-2019-10209","DSA-4493-1","EUVD-2019-2226","GHSA-w4g8-53rg-h648","MGASA-2019-0225","openSUSE-SU-2024:11185-1"],"status":"published","title":"Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type...","description":"Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.","severity":{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01079,"percentile":0.65487,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-200"],"published":"2019-08-08T00:00:00Z","modified":"2026-11-03T06:32:34Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"postgresql","fixed_in":["11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"postgresql","fixed_in":["11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"postgresql","fixed_in":["11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"postgresql","fixed_in":["11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"postgresql","fixed_in":["11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"postgresql","fixed_in":["11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"postgresql14","fixed_in":["11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"postgresql14","fixed_in":["11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"postgresql14","fixed_in":["11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"postgresql14","fixed_in":["11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"postgresql14","fixed_in":["11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"postgresql14","fixed_in":["11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"postgresql15","fixed_in":["11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"postgresql15","fixed_in":["11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"postgresql15","fixed_in":["11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"postgresql15","fixed_in":["11.5-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"postgresql14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"postgresql14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"postgresql14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"postgresql14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"postgresql14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"postgresql14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5-r0"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"postgresql-11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5-1+deb10u1"}]}],"versions":["11.4-1","11.5-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"postgresql9.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.24-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"postgresql9.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.15-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"postgresql9.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.15-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"postgresql11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"postgresql11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.13-1.3"}]}],"bundled":18}],"products":[{"vendor":"postgresql","product":"postgresql"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10209","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://www.postgresql.org/about/news/1960/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10209"},{"url":"https://www.postgresql.org/about/news/1960"},{"url":"https://github.com/advisories/GHSA-w4g8-53rg-h648"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-10209","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-10209","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0225.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25260","tags":["report"]},{"url":"https://www.postgresql.org/docs/9.4/release-9-4-24.html","tags":["web"]},{"url":"https://www.postgresql.org/docs/9.6/release-9-6-15.html","tags":["web"]},{"url":"https://www.postgresql.org/docs/11/release-11-5.html","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3677","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-10209","description":"Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.","status":"published","published":"2019-10-29T13:11:45Z","modified":"2024-08-04T22:17:20.096Z","cvss":[{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-125","CWE-200"],"updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2019-2226","description":"Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.","status":"published","published":"2019-10-29T13:11:45Z","modified":"2024-08-04T22:17:20Z","cvss":[{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T02:40:53.055308Z"}],"ghsa":[{"id":"GHSA-w4g8-53rg-h648","title":"Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type...","description":"Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.","status":"published","published":"2022-05-24T17:00:01Z","modified":"2024-04-04T02:35:52Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:56:09.967552Z"}],"nvd":[{"id":"CVE-2019-10209","description":"Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.","status":"published","published":"2019-10-29T19:15:16.25Z","modified":"2026-06-17T02:10:29.667Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-125","CWE-200"],"updated_at":"2026-11-02T14:05:32.982925Z"}],"osv":[{"id":"ALPINE-CVE-2019-10209","description":"Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.","status":"published","published":"2019-10-29T19:15:16.25Z","modified":"2026-11-03T06:32:34.821106574Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"BELL-CVE-2019-10209","title":"CVE-2019-10209 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:35.760734Z","modified":"2026-01-26T09:48:43.00652Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2019-10209","description":"Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.","status":"published","published":"2019-10-29T19:15:16.25Z","modified":"2026-04-16T04:36:47.019662555Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"DSA-4493-1","title":"postgresql-11 - security update","status":"published","published":"2019-08-08T00:00:00Z","modified":"2026-03-09T02:10:05.021468Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0225","title":"Updated postgresql packages fix security vulnerabilities","description":"Updated postgresql packages fix security vulnerabilities:\n\nGiven a suitable SECURITY DEFINER function, an attacker can execute\narbitrary SQL under the identity of the function owner. An attack requires\nEXECUTE permission on the function, which must itself contain a function\ncall having inexact argument type match. For example, length('foo'::varchar)\nand length('foo') are inexact, while length('foo'::text) is exact\n(CVE-2019-10208).\n\nIn a database containing hypothetical, user-defined hash equality operators,\nan attacker could read arbitrary bytes of server memory. For an attack to\nbecome possible, a superuser would need to create unusual operators. It is\npossible for operators not purpose-crafted for attack to have the properties\nthat enable an attack, but we are not aware of specific examples\n(CVE-2019-10209).\n\nThis update also fixes over 40 bugs that were reported in the last several\nmonths.  See the upstream release notes for details.\n","status":"published","published":"2019-08-18T12:39:41Z","modified":"2026-04-16T04:44:04.348956921Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11185-1","title":"postgresql11-11.13-1.3 on GA media","description":"These are all security issues fixed in the postgresql11-11.13-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:27:47.930292Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}