CVE-2019-10130

A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.

• CWE-284
• CWE-284

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10130Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/202003-03Third Party Advisory
• https://www.postgresql.org/about/news/1939/Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10130Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/202003-03Third Party Advisory
• https://www.postgresql.org/about/news/1939/Vendor Advisory

Published

Jul 30, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10125An issue was discovered in aio_poll() in fs/aio.c in the Lin…9.8
• CVE-2019-10126A flaw was found in the Linux kernel. A heap based buffer ov…9.8
• CVE-2019-10127A vulnerability was found in postgresql versions 11.x prior …8.8
• CVE-2019-10128A vulnerability was found in postgresql versions 11.x prior …7.8
• CVE-2019-10129A vulnerability was found in postgresql versions 11.x prior …6.5
• CVE-2019-1013An information disclosure vulnerability exists when the Wind…4.7
• CVE-2019-10131An off-by-one read vulnerability was discovered in ImageMagi…7.1
• CVE-2019-10132A vulnerability was found in libvirt >= 4.1.0 in the virtloc…8.8
• CVE-2019-10133A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 a…3.1
• CVE-2019-10134A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 a…3.7
• CVE-2019-10135A flaw was found in the yaml.load() function in the osbs-cli…7.2
• CVE-2019-10136It was found that Spacewalk, all versions through 2.9, did n…4.3