A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statist

This vulnerability allows an attacker with SELECT privileges on a table to potentially extract sensitive data from column statistics. PostgreSQL maintains statistics about columns, including histograms and lists of common values, which are used to optimize query execution. The flaw lies in the fact that PostgreSQL doesn't enforce row-level security policies when accessing these statistics during query planning. Consequently, an attacker can craft queries that indirectly reveal the most frequent values within specific columns, even if they shouldn't have direct access to the underlying data. The potential impact ranges from exposure of personally identifiable information (PII) to sensitive business data, depending on the nature of the data stored in the affected columns. While the CVSS score is LOW, the potential for data leakage makes this a significant concern, particularly in environments with strict data privacy regulations.

Organizations running PostgreSQL versions 9.5, 9.6, and 10, particularly those handling sensitive data or operating in regulated industries, are at risk. Environments with complex row-level security policies that are not properly enforced are also more vulnerable. Shared hosting environments where multiple users have access to the same PostgreSQL instance should be carefully assessed.

• postgresql: Use psql to check the PostgreSQL version:

psql -U postgres -c "SELECT version();"

• postgresql: Examine PostgreSQL logs for unusual query patterns or errors related to statistics collection. Look for queries accessing statistics tables directly. • linux / server: Use journalctl to filter for PostgreSQL-related errors or warnings.

journalctl -u postgresql --since "1 week ago" | grep -i error

1. 2019-07-30Disclosure

   disclosure

2. 2019-07-30Patch

   patch

1. Reservado2019-03-27
2. Publicada2019-07-30
3. Modificada2024-08-04
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2019-10130 is to upgrade to PostgreSQL version 11.3 or later, which includes the fix. If an immediate upgrade is not feasible, consider implementing row-level security policies to restrict access to sensitive columns. While not a direct fix, this can limit the attacker's ability to exploit the vulnerability. Additionally, review and restrict SELECT privileges on tables to minimize the potential attack surface. Monitor PostgreSQL logs for unusual query patterns that might indicate exploitation attempts. After upgrading, confirm the fix by running a query that previously triggered the information disclosure and verifying that it no longer reveals sensitive data.