CVE-2019-10211

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
PostgreSQL	postgresql	all 11.x before 11.5; all 10.x before 10.10; all 9.6.x before 9.6.15; all 9.5.x before 9.5.19; all 9.4.x before 9.4.24

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10211Issue Tracking, Third Party Advisory
https://www.postgresql.org/about/news/1960/Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10211Issue Tracking, Third Party Advisory
https://www.postgresql.org/about/news/1960/Vendor Advisory

Timeline

Published: Oct 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-102129.8A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this CVE-2019-102136.5OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator CVE-2019-102145.9The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in Open CVE-2019-102156.1Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could expl CVE-2019-102167.8In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSA CVE-2019-102176.5A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields CVE-2019-102186.5A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a path CVE-2019-102196.1A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potent CVE-2019-10227.8An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary code CVE-2019-102208.8Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.CVE-2019-102216.1A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. CVE-2019-102227.5A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash