PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a (1) ALTER USER or (2) ALTER DATABASE statement.
CVSS Details
- CVSS 3.1 Base Score: 5.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresql-serverUpgrade postgresql-jdbcUpgrade postgresql-testUpgrade postgresql84Upgrade postgresql84-libsUpgrade postgresql-docsUpgrade postgresql84-plpythonUpgrade postgresql84-docsUpgrade postgresql84-contribUpgrade postgresql-tclUpgrade postgresql-develUpgrade postgresql-libsUpgrade postgresql84-pltclUpgrade postgresql-pythonUpgrade postgresql84-tclUpgrade postgresql-plUpgrade postgresql84-serverUpgrade postgresql84-testUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql84-develUpgrade postgresql84-pythonUpgrade postgresql84-plperl | Dec 1, 2016 | May 19, 2010 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-base.Upgrade dev-db/postgresql-server.Upgrade dev-db/postgresql. | Oct 30, 2017 | May 19, 2010 |
| Oracle_linux | — | Upgrade postgresqlUpgrade postgresql84Upgrade postgresql-libsUpgrade postgresql84-develUpgrade postgresql84-plpythonUpgrade postgresql-develUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql84-contribUpgrade postgresql-contribUpgrade postgresql84-testUpgrade postgresql84-libsUpgrade postgresql84-pltclUpgrade postgresql84-tclUpgrade postgresql-plUpgrade postgresql84-pythonUpgrade postgresql84-serverUpgrade postgresql84-docsUpgrade postgresql-pythonUpgrade postgresql-tclUpgrade postgresql84-plperlUpgrade postgresql-test | Oct 16, 2024 | May 19, 2010 |
| Postgres | — | Upgrade to PostgreSQL version 8.0.25Upgrade to PostgreSQL version 7.4.29Upgrade to PostgreSQL version 8.3.11Upgrade to PostgreSQL version 8.1.21Upgrade to PostgreSQL version 8.2.17Upgrade to PostgreSQL version 8.4.4 | Feb 24, 2013 | May 19, 2010 |
| Redhat_linux | — | — | Jul 9, 2025 | May 17, 2010 |
| Suse | — | Upgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-libs-32bitUpgrade postgresql-libs-x86 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-pltcl-8.4Upgrade postgresql-pltcl-8.3Upgrade postgresql-plperl-8.1Upgrade postgresql-pltcl-8.1Upgrade postgresql-plperl-8.4Upgrade postgresql-plperl-8.3 | Nov 8, 2024 | May 19, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub