The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresqlUpgrade postgresql-testUpgrade postgresql-develUpgrade postgresql-plUpgrade postgresql-serverUpgrade postgresql-pythonUpgrade postgresql-jdbcUpgrade postgresql-libsUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-debuginfoUpgrade postgresql-tcl | Dec 1, 2016 | Sep 17, 2009 |
| Gentoo Linux | — | Upgrade dev-db/postgresql.Upgrade dev-db/postgresql-server.Upgrade dev-db/postgresql-base. | Oct 30, 2017 | Sep 17, 2009 |
| Oracle_linux | — | Upgrade postgresql-plUpgrade postgresql-pythonUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-tclUpgrade postgresql-docsUpgrade postgresql-devel | Oct 16, 2024 | Sep 17, 2009 |
| Postgres | — | Upgrade to PostgreSQL version 7.4.26Upgrade to PostgreSQL version 8.4.1Upgrade to PostgreSQL version 8.2.14Upgrade to PostgreSQL version 8.0.22Upgrade to PostgreSQL version 8.1.18Upgrade to PostgreSQL version 8.3.8 | Feb 24, 2013 | Sep 17, 2009 |
| Suse | — | Upgrade postgresql-docsUpgrade postgresql-libs-32bitUpgrade postgresql-libs-x86Upgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-libs | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-8.3Upgrade postgresql-8.1 | Nov 8, 2024 | Sep 17, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub