CVE-2019-10130: Information Disclosure in PostgreSQL

This vulnerability allows an attacker with SELECT privileges on a table to potentially extract sensitive data from column statistics. PostgreSQL maintains statistics about columns, including histograms and lists of common values, which are used to optimize query execution. The flaw lies in the fact that PostgreSQL doesn't enforce row-level security policies when accessing these statistics during query planning. Consequently, an attacker can craft queries that indirectly reveal the most frequent values within specific columns, even if they shouldn't have direct access to the underlying data. The potential impact ranges from exposure of personally identifiable information (PII) to sensitive business data, depending on the nature of the data stored in the affected columns. While the CVSS score is LOW, the potential for data leakage makes this a significant concern, particularly in environments with strict data privacy regulations.

1. Reserved2019-03-27
2. Published2019-07-30
3. Modified2024-08-04
4. EPSS updated2026-04-02

The primary mitigation for CVE-2019-10130 is to upgrade to PostgreSQL version 11.3 or later, which includes the fix. If an immediate upgrade is not feasible, consider implementing row-level security policies to restrict access to sensitive columns. While not a direct fix, this can limit the attacker's ability to exploit the vulnerability. Additionally, review and restrict SELECT privileges on tables to minimize the potential attack surface. Monitor PostgreSQL logs for unusual query patterns that might indicate exploitation attempts. After upgrading, confirm the fix by running a query that previously triggered the information disclosure and verifying that it no longer reveals sensitive data.