PostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached plans, which might allow attackers to bypass intended access restrictions by leveraging a session that performs queries as more than one role.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade postgresql95-serverUpgrade postgresql95-contrib | Dec 10, 2025 | Mar 31, 2016 |
| Postgres | — | Upgrade to PostgreSQL version 9.5.2 | Apr 1, 2016 | Apr 1, 2016 |
| Suse | — | Upgrade postgresql10-docsUpgrade postgresql10-develUpgrade postgresql10-contribUpgrade libpq5-32bitUpgrade postgresql10-plperlUpgrade postgresql96-docsUpgrade postgresql10-pltclUpgrade postgresql96-contribUpgrade postgresql10-serverUpgrade postgresql10-plpythonUpgrade postgresql96-develUpgrade libecpg6Upgrade postgresql10Upgrade postgresql96-serverUpgrade libpq5Upgrade postgresql96 | Jul 21, 2017 | Apr 11, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub