CVE-2019-9193 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2019-9193 Interim 1 23 2026-03-05T06:22:45Z current 2021-05-30T14:25:31Z 2026-03-05T06:22:45Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2019-9193 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for 'COPY TO/FROM PROGRAM' is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the 'COPY FROM PROGRAM'. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SLES for SAP Applications 11 SP3 SUSE Linux Enterprise Server 11 SP1 for Teradata SUSE Linux Enterprise Server 11 SP3 LTSS SUSE Linux Enterprise Server 11 SP3 for Teradata SUSE Linux Enterprise Server 11 SP4-LTSS SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP2 postgresql94 postgresql94-contrib postgresql94-docs postgresql94-plperl postgresql94-plpython postgresql94-pltcl postgresql94-server postgresql94 as a component of SLES for SAP Applications 11 SP3 postgresql94 as a component of SUSE Linux Enterprise Server 11 SP1 for Teradata postgresql94 as a component of SUSE Linux Enterprise Server 11 SP3 LTSS postgresql94 as a component of SUSE Linux Enterprise Server 11 SP3 for Teradata postgresql94 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS postgresql94-contrib as a component of SUSE Linux Enterprise Server 11 SP4-LTSS postgresql94-docs as a component of SUSE Linux Enterprise Server 11 SP4-LTSS postgresql94-server as a component of SUSE Linux Enterprise Server 11 SP4-LTSS postgresql94 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS postgresql94-contrib as a component of SUSE Linux Enterprise Server 12 SP1-LTSS postgresql94-docs as a component of SUSE Linux Enterprise Server 12 SP1-LTSS postgresql94-plperl as a component of SUSE Linux Enterprise Server 12 SP1-LTSS postgresql94-plpython as a component of SUSE Linux Enterprise Server 12 SP1-LTSS postgresql94-pltcl as a component of SUSE Linux Enterprise Server 12 SP1-LTSS postgresql94-server as a component of SUSE Linux Enterprise Server 12 SP1-LTSS postgresql94 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS postgresql94-contrib as a component of SUSE Linux Enterprise Server 12 SP2-LTSS postgresql94-docs as a component of SUSE Linux Enterprise Server 12 SP2-LTSS postgresql94-plperl as a component of SUSE Linux Enterprise Server 12 SP2-LTSS postgresql94-plpython as a component of SUSE Linux Enterprise Server 12 SP2-LTSS postgresql94-pltcl as a component of SUSE Linux Enterprise Server 12 SP2-LTSS postgresql94-server as a component of SUSE Linux Enterprise Server 12 SP2-LTSS postgresql94 as a component of SUSE Linux Enterprise Server 12-LTSS postgresql94-contrib as a component of SUSE Linux Enterprise Server 12-LTSS postgresql94-docs as a component of SUSE Linux Enterprise Server 12-LTSS postgresql94-server as a component of SUSE Linux Enterprise Server 12-LTSS postgresql94 as a component of SUSE Linux Enterprise Server for SAP Applications 12 postgresql94 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 postgresql94-contrib as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 postgresql94-docs as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 postgresql94-plperl as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 postgresql94-plpython as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 postgresql94-pltcl as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 postgresql94-server as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for 'COPY TO/FROM PROGRAM' is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the 'COPY FROM PROGRAM'. CVE-2019-9193 SLES for SAP Applications 11 SP3:postgresql94 SUSE Linux Enterprise Server 11 SP3 LTSS:postgresql94 SUSE Linux Enterprise Server 11 SP4-LTSS:postgresql94 SUSE Linux Enterprise Server 11 SP4-LTSS:postgresql94-contrib SUSE Linux Enterprise Server 11 SP4-LTSS:postgresql94-docs SUSE Linux Enterprise Server 11 SP4-LTSS:postgresql94-server SUSE Linux Enterprise Server 12 SP1-LTSS:postgresql94 SUSE Linux Enterprise Server 12 SP1-LTSS:postgresql94-contrib SUSE Linux Enterprise Server 12 SP1-LTSS:postgresql94-docs SUSE Linux Enterprise Server 12 SP1-LTSS:postgresql94-plperl SUSE Linux Enterprise Server 12 SP1-LTSS:postgresql94-plpython SUSE Linux Enterprise Server 12 SP1-LTSS:postgresql94-pltcl SUSE Linux Enterprise Server 12 SP1-LTSS:postgresql94-server SUSE Linux Enterprise Server 12 SP2-LTSS:postgresql94 SUSE Linux Enterprise Server 12 SP2-LTSS:postgresql94-contrib SUSE Linux Enterprise Server 12 SP2-LTSS:postgresql94-docs SUSE Linux Enterprise Server 12 SP2-LTSS:postgresql94-plperl SUSE Linux Enterprise Server 12 SP2-LTSS:postgresql94-plpython SUSE Linux Enterprise Server 12 SP2-LTSS:postgresql94-pltcl SUSE Linux Enterprise Server 12 SP2-LTSS:postgresql94-server SUSE Linux Enterprise Server 12-LTSS:postgresql94 SUSE Linux Enterprise Server 12-LTSS:postgresql94-contrib SUSE Linux Enterprise Server 12-LTSS:postgresql94-docs SUSE Linux Enterprise Server 12-LTSS:postgresql94-server SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-contrib SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-docs SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-plperl SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-plpython SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-pltcl SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-server SUSE Linux Enterprise Server for SAP Applications 12:postgresql94 moderate 9 AV:N/AC:L/Au:S/C:C/I:C/A:C 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H