The query planner in PostgreSQL before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 does not verify that a table is compatible with a "previously made query plan," which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content via an "ALTER COLUMN TYPE" SQL statement, which can be leveraged to read arbitrary memory from the server.
CVSS Details
- CVSS 3.1 Base Score: 8.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 30, 2017 | Feb 5, 2007 |
| Oracle_linux | — | Upgrade postgresql-pythonUpgrade postgresql-contribUpgrade postgresql-tclUpgrade postgresql-docsUpgrade postgresql-plUpgrade postgresql-develUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql | Oct 16, 2024 | Feb 6, 2007 |
| Suse | — | Upgrade postgresql-libs-32bitUpgrade postgresql-libs-x86Upgrade suse-releaseUpgrade postgresql-libsUpgrade postgresql-develUpgrade postgresql-libs-64bitUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-pl | Feb 17, 2015 | Feb 5, 2007 |
| Ubuntu | — | Upgrade postgresql-8.0Upgrade postgresql-8.1Upgrade postgresql-7.4 | Nov 8, 2024 | Feb 6, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub