PostgreSQL 9.5.x < 9.5.17, 9.6.x < 9.6.13, 10.x < 10.8, 11.x < 11.3 Information Disclosure Vulnerability (Windows)

PostgreSQL is prone to an information disclosure vulnerability due to selectivity estimators bypass row security policies.

PostgreSQL maintains statistics for tables by sampling data available in columns. This data is consulted during the query planning process. Prior to this release, a user able to execute SQL queries with permissions to read a given column could craft a leaky operator that could read whatever data had been sampled from that column. If this happened to include values from rows that the user is forbidden to see by a row security policy, the user could effectively bypass the policy.

PostgreSQL versions 9.5.x, 9.6.x, 10.x and 11.x.

Checks if a vulnerable version is present on the target host.

Update to version 9.5.17, 9.6.13, 10.8, 11.3 or later.