INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresqlUpgrade postgresql15 | Nov 23, 2017 | Nov 22, 2017 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql96 | Dec 7, 2017 | Oct 10, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 22, 2017 |
| Debian | — | Upgrade postgresql-9.6 | Dec 5, 2017 | Oct 10, 2017 |
| Freebsd | — | Upgrade postgresql10-serverUpgrade postgresql94-serverUpgrade postgresql93-serverUpgrade postgresql95-serverUpgrade postgresql96-serverUpgrade postgresql92-server | Nov 9, 2017 | Nov 9, 2017 |
| Postgres | — | Upgrade to PostgreSQL version 10.1 | Nov 10, 2017 | Nov 10, 2017 |
| Suse | — | Upgrade postgresql10-contribUpgrade postgresql10-plpythonUpgrade libpq5Upgrade postgresql10-pltclUpgrade postgresql96-contribUpgrade postgresql96-develUpgrade libecpg6Upgrade postgresql96-docsUpgrade postgresql96Upgrade postgresql10-plperlUpgrade postgresql10Upgrade postgresql96-serverUpgrade postgresql10-docsUpgrade libpq5-32bitUpgrade postgresql10-develUpgrade postgresql10-server | Dec 21, 2017 | Oct 10, 2017 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-9.3Upgrade postgresql-9.6 | Nov 14, 2017 | Oct 10, 2017 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub