CVE-2019-10127: 
PostgreSQL vulnerability analysis and mitigation

A vulnerability was discovered in PostgreSQL versions 11.x prior to 11.3, specifically affecting the Windows installer provided by BigSQL. The vulnerability was assigned CVE-2019-10127 and was disclosed on May 9, 2019. The issue affects the access control list (ACL) permissions of both the binary installation directory and the data directory, where the installer maintains inherited ACL entries instead of implementing proper security restrictions (PostgreSQL News).

The vulnerability stems from improper permission settings during installation, where the BigSQL Windows installer fails to lock down the ACL permissions of both the PostgreSQL binary installation directory and the data directory. The vulnerability has been assigned a CVSS v3.1 score of 8.8 (HIGH) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating local access requirements but high impact potential (NetApp Advisory).

The vulnerability's impact is significant in the default configuration. An attacker with both an unprivileged Windows account and an unprivileged PostgreSQL account can potentially execute arbitrary code using the PostgreSQL service account. Additionally, an attacker with only an unprivileged Windows account can read arbitrary data directory files, effectively bypassing database-imposed read access limitations, and can also delete certain data directory files (NVD).

The vulnerability was fixed in PostgreSQL 11.3. The BigSQL installer has been updated to properly set permissions for these directories for both new and existing installations. For users who installed PostgreSQL on Windows using other methods, it is recommended to verify that PostgreSQL binary directories are writable only to trusted users and that data directories are only accessible to trusted users (PostgreSQL News).

The vulnerability was discovered and reported by Conner Jones, demonstrating the active security research community's involvement in PostgreSQL security. The PostgreSQL Global Development Group responded promptly by releasing fixes and coordinating with affected installation providers (PostgreSQL News).