It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresql | Aug 30, 2017 | May 12, 2017 |
| Amazon_linux | — | Upgrade postgresql94Upgrade postgresql92Upgrade postgresql95Upgrade postgresql93 | Jun 7, 2017 | May 12, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 12, 2017 |
| Centos_linux | — | Upgrade postgresql-develUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-static | Aug 28, 2019 | May 12, 2017 |
| Debian | — | Upgrade postgresql-9.6 | May 14, 2017 | May 12, 2017 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 30, 2017 | May 12, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-pltcl | Jan 18, 2018 | May 12, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade postgresql-develUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-plperl | Jan 18, 2018 | May 12, 2017 |
| Oracle_linux | — | Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-plpythonUpgrade postgresql-docsUpgrade postgresql | Aug 8, 2017 | May 11, 2017 |
| Postgres | — | Upgrade to PostgreSQL version 9.5.7Upgrade to PostgreSQL version 9.4.12Upgrade to PostgreSQL version 9.3.17Upgrade to PostgreSQL version 9.2.21Upgrade to PostgreSQL version 9.6.3 | May 15, 2017 | May 12, 2017 |
| Redhat_linux | — | Upgrade postgresql-libsUpgrade postgresql-plpythonNo solution existsUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-debuginfoUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-upgradeUpgrade postgresql-devel | Aug 6, 2017 | May 12, 2017 |
| Suse | — | Upgrade postgresql93-contribUpgrade postgresql10Upgrade libpq5Upgrade libpq5-32bitUpgrade postgresql10-contribUpgrade libecpg6Upgrade postgresql10-serverUpgrade postgresql96-develUpgrade postgresql10-develUpgrade postgresql96-docsUpgrade postgresql94-serverUpgrade postgresql93-serverUpgrade postgresql10-pltclUpgrade postgresql96-serverUpgrade postgresql94Upgrade postgresql93Upgrade postgresql94-contribUpgrade postgresql96-contribUpgrade postgresql10-plpythonUpgrade postgresql93-docsUpgrade postgresql96Upgrade postgresql94-develUpgrade postgresql10-docsUpgrade postgresql94-docsUpgrade postgresql10-plperl | May 31, 2017 | May 12, 2017 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-9.3Upgrade postgresql-9.6 | Nov 19, 2024 | May 12, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub