It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql15Upgrade postgresql14 | Aug 30, 2017 | May 12, 2017 |
| Amazon_linux | — | Upgrade postgresql94Upgrade postgresql92Upgrade postgresql95Upgrade postgresql93 | Jun 7, 2017 | May 12, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 12, 2017 |
| Centos_linux | — | Upgrade postgresql-testUpgrade postgresql-debuginfoUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade postgresql-develUpgrade postgresql-plpythonUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql-contribUpgrade postgresql | Aug 28, 2019 | May 12, 2017 |
| Debian | — | Upgrade postgresql-9.6 | May 14, 2017 | May 12, 2017 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 30, 2017 | May 12, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-docs | Jan 18, 2018 | May 12, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-devel | Jan 18, 2018 | May 12, 2017 |
| Oracle_linux | — | Upgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-staticUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-develUpgrade postgresql-contrib | Aug 8, 2017 | May 11, 2017 |
| Postgres | — | Upgrade to PostgreSQL version 9.6.3Upgrade to PostgreSQL version 9.2.21Upgrade to PostgreSQL version 9.5.7Upgrade to PostgreSQL version 9.4.12Upgrade to PostgreSQL version 9.3.17 | May 15, 2017 | May 12, 2017 |
| Redhat_linux | — | Upgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-plpythonNo solution existsUpgrade postgresql-debuginfoUpgrade postgresql-testUpgrade postgresql-upgradeUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-contrib | Aug 6, 2017 | May 12, 2017 |
| Suse | — | Upgrade postgresql93Upgrade postgresql96-contribUpgrade postgresql10-pltclUpgrade postgresql94-serverUpgrade postgresql94Upgrade postgresql93-serverUpgrade postgresql94-contribUpgrade postgresql10-docsUpgrade postgresql96-serverUpgrade postgresql94-develUpgrade postgresql96Upgrade postgresql93-docsUpgrade postgresql10-plpythonUpgrade postgresql10-plperlUpgrade postgresql96-docsUpgrade postgresql94-docsUpgrade postgresql10-contribUpgrade libpq5Upgrade libecpg6Upgrade postgresql10-serverUpgrade postgresql10Upgrade postgresql96-develUpgrade postgresql10-develUpgrade libpq5-32bitUpgrade postgresql93-contrib | May 31, 2017 | May 12, 2017 |
| Ubuntu | — | Upgrade postgresql-9.3Upgrade postgresql-9.6Upgrade postgresql-9.5 | Nov 19, 2024 | May 12, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub