corrective updates for all supported branches of PostgreSQL: , , , and Release of updates for version 9.4 until December 2019, 9.5 until January 2021, 9.6 — until September 2021, 10 — until October 2022, 11 — until November 2023.
In the new versions, 25 bugs have been fixed and a vulnerability (CVE-2019-10164) has been addressed, which could lead to a buffer overflow when a user changes their password. This vulnerability allows a local attacker with access to PostgreSQL to execute their code with the same rights as the user under which the database system runs by setting a very long password. Furthermore, the vulnerability can be exploited on the user side during the SCRAM authentication process using the libpq client when the user interacts with a PostgreSQL server controlled by the attacker. The issue is present in PostgreSQL versions 10, 11, and 12-beta.
Source: opennet.ru
