An authenticated user could create a stack-based buffer overflow
by changing their own password to a purpose-crafted value. In addition
to the ability to crash the PostgreSQL server, this could be further
exploited to execute arbitrary code as the PostgreSQL operating system account.
Additionally, a rogue server could send a specifically crafted
message during the SCRAM authentication process and cause a libpq-enabled client
to either crash or execute arbitrary code as the client's operating system account.
This issue is fixed by upgrading and restarting your PostgreSQL
server as well as your libpq installations. All users running
PostgreSQL 10, 11, and 12 beta are encouraged to upgrade as soon as possible.