The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular table, they could exploit this to update other columns in the same table.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresql | Aug 22, 2024 | Aug 9, 2018 |
| Amazon_linux | — | Upgrade postgresql93Upgrade postgresql94Upgrade postgresql95Upgrade postgresql96Upgrade postgresql95 | Sep 7, 2018 | Aug 9, 2018 |
| Debian | — | Upgrade postgresql-9.6 | Aug 12, 2018 | Aug 9, 2018 |
| Freebsd | — | Upgrade postgresql95-serverUpgrade postgresql93-serverUpgrade postgresql10-serverUpgrade postgresql94-serverUpgrade postgresql96-server | Aug 11, 2018 | Aug 10, 2018 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 31, 2018 | Aug 9, 2018 |
| Postgres | — | Upgrade to PostgreSQL version 10.5 | Jan 7, 2019 | Aug 9, 2018 |
| Suse | — | Upgrade postgresql96-pltclUpgrade libecpg6Upgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql96Upgrade postgresql12-serverUpgrade libpq5-32bitUpgrade postgresql10-contribUpgrade postgresql10-develUpgrade postgresql12-docsUpgrade postgresql10Upgrade postgresql-contribUpgrade postgresql-llvmjitUpgrade postgresql-pltclUpgrade postgresql10-docsUpgrade postgresql10-serverUpgrade postgresql-server-develUpgrade libecpg6-32bitUpgrade postgresql96-develUpgrade postgresql10-plperlUpgrade postgresql12-llvmjitUpgrade postgresql12-contribUpgrade postgresql96-plpythonUpgrade postgresql12-develUpgrade postgresql-plperlUpgrade postgresql12-plperlUpgrade postgresql96-contribUpgrade libpq5Upgrade postgresql10-pltclUpgrade postgresql96-docsUpgrade postgresql10-plpythonUpgrade postgresql96-testUpgrade postgresql-docsUpgrade postgresql12-plpythonUpgrade postgresql12-server-develUpgrade postgresql12-pltclUpgrade postgresql96-plperlUpgrade postgresql-testUpgrade postgresql12-testUpgrade postgresql12Upgrade postgresql10-testUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql96-server | Sep 5, 2018 | Aug 9, 2018 |
| Ubuntu | — | Upgrade postgresql-9.3Upgrade postgresql-9.5Upgrade postgresql-10 | Aug 23, 2018 | Aug 9, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub