It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql15Upgrade postgresql14 | Aug 30, 2017 | May 12, 2017 |
| Amazon_linux | — | Upgrade postgresql94Upgrade postgresql92Upgrade postgresql93Upgrade postgresql95 | Jun 7, 2017 | May 12, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 12, 2017 |
| Centos_linux | — | Upgrade postgresql-upgradeUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-staticUpgrade postgresql-debuginfoUpgrade postgresql-testUpgrade postgresql-docs | Aug 28, 2019 | May 12, 2017 |
| Debian | — | Upgrade postgresql-9.6 | May 14, 2017 | May 12, 2017 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 30, 2017 | May 12, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-develUpgrade postgresql-plpython | Jan 18, 2018 | May 12, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-develUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql | Jan 18, 2018 | May 12, 2017 |
| Oracle_linux | — | Upgrade postgresql-develUpgrade postgresql-upgradeUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-staticUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-plpython | Aug 8, 2017 | May 11, 2017 |
| Postgres | — | Upgrade to PostgreSQL version 9.2.21Upgrade to PostgreSQL version 9.6.3Upgrade to PostgreSQL version 9.4.12Upgrade to PostgreSQL version 9.3.17Upgrade to PostgreSQL version 9.5.7 | May 15, 2017 | May 12, 2017 |
| Redhat_linux | — | Upgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql-serverNo solution existsUpgrade postgresqlUpgrade postgresql-plpythonUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade postgresql-plperlUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgresql-docsUpgrade postgresql-static | Aug 6, 2017 | May 12, 2017 |
| Suse | — | Upgrade postgresql94-contribUpgrade postgresql93Upgrade postgresql10-docsUpgrade postgresql10-plperlUpgrade postgresql94-develUpgrade postgresql93-serverUpgrade postgresql94-docsUpgrade postgresql96-contribUpgrade postgresql96-serverUpgrade postgresql10-pltclUpgrade postgresql96Upgrade postgresql94Upgrade postgresql10-plpythonUpgrade postgresql93-docsUpgrade postgresql94-serverUpgrade postgresql96-docsUpgrade postgresql10-serverUpgrade postgresql10-contribUpgrade libpq5-32bitUpgrade libecpg6Upgrade postgresql10Upgrade postgresql10-develUpgrade postgresql96-develUpgrade postgresql93-contribUpgrade libpq5 | May 31, 2017 | May 12, 2017 |
| Ubuntu | — | Upgrade postgresql-9.6Upgrade postgresql-9.3Upgrade postgresql-9.5 | Nov 19, 2024 | May 12, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub