The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresql-tclUpgrade postgresql-debuginfoUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-pythonUpgrade postgresql-plUpgrade postgresql-jdbcUpgrade postgresql-libsUpgrade postgresql-contribUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql | Dec 1, 2016 | Sep 17, 2009 |
| Gentoo Linux | — | Upgrade dev-db/postgresql.Upgrade dev-db/postgresql-server.Upgrade dev-db/postgresql-base. | Oct 30, 2017 | Sep 17, 2009 |
| Oracle_linux | — | Upgrade postgresql-tclUpgrade postgresql-develUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-pythonUpgrade postgresql-plUpgrade postgresql-libs | Oct 16, 2024 | Sep 17, 2009 |
| Postgres | — | Upgrade to PostgreSQL version 8.0.22Upgrade to PostgreSQL version 8.4.1Upgrade to PostgreSQL version 8.2.14Upgrade to PostgreSQL version 7.4.26Upgrade to PostgreSQL version 8.3.8Upgrade to PostgreSQL version 8.1.18 | Feb 24, 2013 | Sep 17, 2009 |
| Suse | — | Upgrade postgresql-libs-x86Upgrade postgresql-libs-32bitUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-contribUpgrade postgresql | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-8.1Upgrade postgresql-8.3 | Nov 8, 2024 | Sep 17, 2009 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub