OS Command Injection The advisory has been revoked - it doesn't affect any version of package postgresql-11 Open this link in a new tab

Threat Intelligence

Exploit Maturity Mature

EPSS 97.49% (100^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-DEBIAN10-POSTGRESQL11-342098
published 1 Apr 2019
disclosed 1 Apr 2019

Report a new vulnerability Found a mistake?

Introduced: 1 Apr 2019

CVE-2019-9193 Open this link in a new tab CWE-78 Open this link in a new tab

Amendment

The Debian security team deemed this advisory irrelevant for Debian:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream postgresql-11 package and not the postgresql-11 package as distributed by Debian.

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.