CVE-2019-10208

A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.

References

Affected packages

Git /

Affected ranges

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "9.4.0"
            },
            {
                "fixed": "9.4.24"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "9.5.0"
            },
            {
                "fixed": "9.5.19"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "9.6.0"
            },
            {
                "fixed": "9.6.15"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "10.0"
            },
            {
                "fixed": "10.10"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "11.0"
            },
            {
                "fixed": "11.5"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10208.json"