#VU20006 Untrusted search path in PostgreSQL - CVE-2019-10211

Vulnerability identifier: #VU20006

Vulnerability risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-10211

CWE-ID: CWE-426

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
PostgreSQL
Server applications / Database software

Vendor: PostgreSQL Global Development Group

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to EnterpriseDB Windows installer bundles an OpenSSL library that tries to load configuration from a hard-coded location on the system. This location usually does not exists, therefore an attacker can create a folder, place malicious configuration file in it and execute the configuration.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

PostgreSQL: 9.4 - 9.4.23, 9.5 - 9.5.18, 9.6.0 - 9.6.14, 10.0 - 11.4

---

External links
https://www.postgresql.org/about/news/1960/

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.