It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresqlUpgrade postgresql15 | Aug 30, 2017 | May 12, 2017 |
| Amazon_linux | — | Upgrade postgresql92Upgrade postgresql95Upgrade postgresql93Upgrade postgresql94 | Jun 7, 2017 | May 12, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 12, 2017 |
| Centos_linux | — | Upgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-libsUpgrade postgresql-upgradeUpgrade postgresql-develUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-debuginfoUpgrade postgresql-static | Aug 28, 2019 | May 12, 2017 |
| Debian | — | Upgrade postgresql-9.6 | May 14, 2017 | May 12, 2017 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 30, 2017 | May 12, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql | Jan 18, 2018 | May 12, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-contrib | Jan 18, 2018 | May 12, 2017 |
| Oracle_linux | — | Upgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgresql-develUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-staticUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-plpython | Aug 8, 2017 | May 11, 2017 |
| Postgres | — | Upgrade to PostgreSQL version 9.5.7Upgrade to PostgreSQL version 9.3.17Upgrade to PostgreSQL version 9.4.12Upgrade to PostgreSQL version 9.2.21Upgrade to PostgreSQL version 9.6.3 | May 15, 2017 | May 12, 2017 |
| Redhat_linux | — | Upgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-upgradeUpgrade postgresql-develNo solution existsUpgrade postgresql-debuginfoUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-libsUpgrade postgresql-plperl | Aug 6, 2017 | May 12, 2017 |
| Suse | — | Upgrade postgresql96-develUpgrade libecpg6Upgrade postgresql10-contribUpgrade libpq5-32bitUpgrade postgresql10Upgrade postgresql10-serverUpgrade postgresql93-contribUpgrade postgresql10-develUpgrade libpq5Upgrade postgresql94-develUpgrade postgresql94-contribUpgrade postgresql93Upgrade postgresql96-serverUpgrade postgresql94Upgrade postgresql10-pltclUpgrade postgresql96-contribUpgrade postgresql10-docsUpgrade postgresql96Upgrade postgresql10-plpythonUpgrade postgresql94-serverUpgrade postgresql94-docsUpgrade postgresql93-docsUpgrade postgresql96-docsUpgrade postgresql93-serverUpgrade postgresql10-plperl | May 31, 2017 | May 12, 2017 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-9.3Upgrade postgresql-9.6 | Nov 19, 2024 | May 12, 2017 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub