CVE-2010-3433 [Medium] | Security Vulnerability in Postgresql

The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 before 7.4.30, 8.0 before 8.0.26, 8.1 before 8.1.22, 8.2 before 8.2.18, 8.3 before 8.3.12, 8.4 before 8.4.5, and 9.0 before 9.0.1 do not properly protect script execution by a different SQL user identity within the same session, which allows remote authenticated users to gain privileges via crafted script code in a SECURITY DEFINER function, as demonstrated by (1) redefining standard functions or (2) redefining operators, a different vulnerability than CVE-2010-1168, CVE-2010-1169, CVE-2010-1170, and CVE-2010-1447.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	1.68%	3.33%	+1.65%
2	2026-02-01	1.62%	1.68%	+0.06%
3	2025-07-31	—	1.62%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

1.68%

3.33%

+1.65%

2026-02-01

1.62%

1.68%

+0.06%

2025-07-31

—

1.62%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
6.0	2.0	MEDIUM	`AV:N/AC:M/Au:S/C:P/I:P/A:P` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:M) Exploitation needs some favorable conditions, but not exceptional ones. Authentication (AU:S) A single authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:P) Partial availability impact.	6.8	6.4	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

6.0

2.0

MEDIUM

AV:N/AC:M/Au:S/C:P/I:P/A:P Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:M): Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:S): A single authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:P): Partial availability impact.

6.8

6.4

[email protected]

OS Trackers for CVE-2010-3433

vendor	priority	summary	link
`gentoo`	normal	CVE-2010-3433: 1 GLSA(s) (201110-22), 3 atom(s) (dev-db/postgresql, dev-db/postgresql-base, dev-db/postgresql-server); latest impact normal.	https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2010-3433
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2010-3433
`ubuntu`	medium	CVE-2010-3433 medium priority: Ubuntu including 6 source packages (postgresql-7.4, postgresql-8.0, postgresql-8.1, postgresql-8.2, postgresql-8.3, postgresql-8.4), 54 status rows across 9 suites (dapper, hardy, jaunty, karmic, lucid, maverick, natty, oneiric, upstream): DNE 36, released 11, ignored 4, needs-triage 3.	https://ubuntu.com/security/CVE-2010-3433

Affected software / configurations for CVE-2010-3433

Vendor	Product	Version	Raw CPE
postgresql	postgresql	7.4	cpe:2.3:a:postgresql:postgresql:7.4:::::::*
postgresql	postgresql	7.4.1	cpe:2.3:a:postgresql:postgresql:7.4.1:::::::*
postgresql	postgresql	7.4.2	cpe:2.3:a:postgresql:postgresql:7.4.2:::::::*
postgresql	postgresql	7.4.3	cpe:2.3:a:postgresql:postgresql:7.4.3:::::::*
postgresql	postgresql	7.4.4	cpe:2.3:a:postgresql:postgresql:7.4.4:::::::*
postgresql	postgresql	7.4.5	cpe:2.3:a:postgresql:postgresql:7.4.5:::::::*
postgresql	postgresql	7.4.6	cpe:2.3:a:postgresql:postgresql:7.4.6:::::::*
postgresql	postgresql	7.4.7	cpe:2.3:a:postgresql:postgresql:7.4.7:::::::*
postgresql	postgresql	7.4.8	cpe:2.3:a:postgresql:postgresql:7.4.8:::::::*
postgresql	postgresql	7.4.9	cpe:2.3:a:postgresql:postgresql:7.4.9:::::::*
postgresql	postgresql	7.4.10	cpe:2.3:a:postgresql:postgresql:7.4.10:::::::*
postgresql	postgresql	7.4.11	cpe:2.3:a:postgresql:postgresql:7.4.11:::::::*
postgresql	postgresql	7.4.12	cpe:2.3:a:postgresql:postgresql:7.4.12:::::::*
postgresql	postgresql	7.4.13	cpe:2.3:a:postgresql:postgresql:7.4.13:::::::*
postgresql	postgresql	7.4.14	cpe:2.3:a:postgresql:postgresql:7.4.14:::::::*
postgresql	postgresql	7.4.15	cpe:2.3:a:postgresql:postgresql:7.4.15:::::::*
postgresql	postgresql	7.4.16	cpe:2.3:a:postgresql:postgresql:7.4.16:::::::*
postgresql	postgresql	7.4.17	cpe:2.3:a:postgresql:postgresql:7.4.17:::::::*
postgresql	postgresql	7.4.18	cpe:2.3:a:postgresql:postgresql:7.4.18:::::::*
postgresql	postgresql	7.4.19	cpe:2.3:a:postgresql:postgresql:7.4.19:::::::*
postgresql	postgresql	7.4.20	cpe:2.3:a:postgresql:postgresql:7.4.20:::::::*
postgresql	postgresql	7.4.21	cpe:2.3:a:postgresql:postgresql:7.4.21:::::::*
postgresql	postgresql	7.4.22	cpe:2.3:a:postgresql:postgresql:7.4.22:::::::*
postgresql	postgresql	7.4.23	cpe:2.3:a:postgresql:postgresql:7.4.23:::::::*
postgresql	postgresql	7.4.24	cpe:2.3:a:postgresql:postgresql:7.4.24:::::::*
postgresql	postgresql	7.4.25	cpe:2.3:a:postgresql:postgresql:7.4.25:::::::*
postgresql	postgresql	7.4.26	cpe:2.3:a:postgresql:postgresql:7.4.26:::::::*
postgresql	postgresql	7.4.27	cpe:2.3:a:postgresql:postgresql:7.4.27:::::::*
postgresql	postgresql	7.4.28	cpe:2.3:a:postgresql:postgresql:7.4.28:::::::*
postgresql	postgresql	7.4.29	cpe:2.3:a:postgresql:postgresql:7.4.29:::::::*
postgresql	postgresql	8.0	cpe:2.3:a:postgresql:postgresql:8.0:::::::*
postgresql	postgresql	8.0.1	cpe:2.3:a:postgresql:postgresql:8.0.1:::::::*
postgresql	postgresql	8.0.2	cpe:2.3:a:postgresql:postgresql:8.0.2:::::::*
postgresql	postgresql	8.0.3	cpe:2.3:a:postgresql:postgresql:8.0.3:::::::*
postgresql	postgresql	8.0.4	cpe:2.3:a:postgresql:postgresql:8.0.4:::::::*
postgresql	postgresql	8.0.5	cpe:2.3:a:postgresql:postgresql:8.0.5:::::::*
postgresql	postgresql	8.0.6	cpe:2.3:a:postgresql:postgresql:8.0.6:::::::*
postgresql	postgresql	8.0.7	cpe:2.3:a:postgresql:postgresql:8.0.7:::::::*
postgresql	postgresql	8.0.8	cpe:2.3:a:postgresql:postgresql:8.0.8:::::::*
postgresql	postgresql	8.0.9	cpe:2.3:a:postgresql:postgresql:8.0.9:::::::*
postgresql	postgresql	8.0.10	cpe:2.3:a:postgresql:postgresql:8.0.10:::::::*
postgresql	postgresql	8.0.11	cpe:2.3:a:postgresql:postgresql:8.0.11:::::::*
postgresql	postgresql	8.0.12	cpe:2.3:a:postgresql:postgresql:8.0.12:::::::*
postgresql	postgresql	8.0.13	cpe:2.3:a:postgresql:postgresql:8.0.13:::::::*
postgresql	postgresql	8.0.14	cpe:2.3:a:postgresql:postgresql:8.0.14:::::::*
postgresql	postgresql	8.0.15	cpe:2.3:a:postgresql:postgresql:8.0.15:::::::*
postgresql	postgresql	8.0.16	cpe:2.3:a:postgresql:postgresql:8.0.16:::::::*
postgresql	postgresql	8.0.17	cpe:2.3:a:postgresql:postgresql:8.0.17:::::::*
postgresql	postgresql	8.0.18	cpe:2.3:a:postgresql:postgresql:8.0.18:::::::*
postgresql	postgresql	8.0.19	cpe:2.3:a:postgresql:postgresql:8.0.19:::::::*
postgresql	postgresql	8.0.20	cpe:2.3:a:postgresql:postgresql:8.0.20:::::::*
postgresql	postgresql	8.0.21	cpe:2.3:a:postgresql:postgresql:8.0.21:::::::*
postgresql	postgresql	8.0.22	cpe:2.3:a:postgresql:postgresql:8.0.22:::::::*
postgresql	postgresql	8.0.23	cpe:2.3:a:postgresql:postgresql:8.0.23:::::::*
postgresql	postgresql	8.0.24	cpe:2.3:a:postgresql:postgresql:8.0.24:::::::*
postgresql	postgresql	8.0.25	cpe:2.3:a:postgresql:postgresql:8.0.25:::::::*
postgresql	postgresql	8.1	cpe:2.3:a:postgresql:postgresql:8.1:::::::*
postgresql	postgresql	8.1.1	cpe:2.3:a:postgresql:postgresql:8.1.1:::::::*
postgresql	postgresql	8.1.2	cpe:2.3:a:postgresql:postgresql:8.1.2:::::::*
postgresql	postgresql	8.1.3	cpe:2.3:a:postgresql:postgresql:8.1.3:::::::*
postgresql	postgresql	8.1.4	cpe:2.3:a:postgresql:postgresql:8.1.4:::::::*
postgresql	postgresql	8.1.5	cpe:2.3:a:postgresql:postgresql:8.1.5:::::::*
postgresql	postgresql	8.1.6	cpe:2.3:a:postgresql:postgresql:8.1.6:::::::*
postgresql	postgresql	8.1.7	cpe:2.3:a:postgresql:postgresql:8.1.7:::::::*
postgresql	postgresql	8.1.8	cpe:2.3:a:postgresql:postgresql:8.1.8:::::::*
postgresql	postgresql	8.1.9	cpe:2.3:a:postgresql:postgresql:8.1.9:::::::*
postgresql	postgresql	8.1.10	cpe:2.3:a:postgresql:postgresql:8.1.10:::::::*
postgresql	postgresql	8.1.11	cpe:2.3:a:postgresql:postgresql:8.1.11:::::::*
postgresql	postgresql	8.1.12	cpe:2.3:a:postgresql:postgresql:8.1.12:::::::*
postgresql	postgresql	8.1.13	cpe:2.3:a:postgresql:postgresql:8.1.13:::::::*
postgresql	postgresql	8.1.14	cpe:2.3:a:postgresql:postgresql:8.1.14:::::::*
postgresql	postgresql	8.1.15	cpe:2.3:a:postgresql:postgresql:8.1.15:::::::*
postgresql	postgresql	8.1.16	cpe:2.3:a:postgresql:postgresql:8.1.16:::::::*
postgresql	postgresql	8.1.17	cpe:2.3:a:postgresql:postgresql:8.1.17:::::::*
postgresql	postgresql	8.1.18	cpe:2.3:a:postgresql:postgresql:8.1.18:::::::*
postgresql	postgresql	8.1.19	cpe:2.3:a:postgresql:postgresql:8.1.19:::::::*
postgresql	postgresql	8.1.20	cpe:2.3:a:postgresql:postgresql:8.1.20:::::::*
postgresql	postgresql	8.1.21	cpe:2.3:a:postgresql:postgresql:8.1.21:::::::*
postgresql	postgresql	8.2	cpe:2.3:a:postgresql:postgresql:8.2:::::::*
postgresql	postgresql	8.2.1	cpe:2.3:a:postgresql:postgresql:8.2.1:::::::*

References for CVE-2010-3433

URL	Tags
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049591.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049592.html
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html
http://marc.info/?l=bugtraq&m=134124585221119&w=2
http://secunia.com/advisories/42325
http://www.debian.org/security/2010/dsa-2120
http://www.mandriva.com/security/advisories?name=MDVSA-2010:197
http://www.postgresql.org/about/news.1244	Patch Vendor Advisory
http://www.postgresql.org/docs/9.0/static/release-9-0-1.html
http://www.redhat.com/support/errata/RHSA-2010-0742.html
http://www.redhat.com/support/errata/RHSA-2010-0908.html
http://www.securityfocus.com/bid/43747
http://www.ubuntu.com/usn/USN-1002-1
http://www.ubuntu.com/usn/USN-1002-2
http://www.vupen.com/english/advisories/2010/3051
https://bugzilla.redhat.com/show_bug.cgi?id=639371
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7291

URL

CVE-2010-3433

Exploit prediction scoring system (EPSS) score for CVE-2010-3433

Common vulnerability scoring system (CVSS) metrics for CVE-2010-3433

Weakness enumeration for CVE-2010-3433

OS Trackers for CVE-2010-3433

Affected software / configurations for CVE-2010-3433

References for CVE-2010-3433