It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql15Upgrade postgresql14 | Aug 30, 2017 | May 12, 2017 |
| Amazon_linux | — | Upgrade postgresql92Upgrade postgresql93Upgrade postgresql95Upgrade postgresql94 | Jun 7, 2017 | May 12, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 12, 2017 |
| Centos_linux | — | Upgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-upgradeUpgrade postgresql-develUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql | Aug 28, 2019 | May 12, 2017 |
| Debian | — | Upgrade postgresql-9.6 | May 14, 2017 | May 12, 2017 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 30, 2017 | May 12, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade postgresqlUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-plpython | Jan 18, 2018 | May 12, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-develUpgrade postgresql-server | Jan 18, 2018 | May 12, 2017 |
| Oracle_linux | — | Upgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-upgradeUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql | Aug 8, 2017 | May 11, 2017 |
| Postgres | — | Upgrade to PostgreSQL version 9.6.3Upgrade to PostgreSQL version 9.2.21Upgrade to PostgreSQL version 9.4.12Upgrade to PostgreSQL version 9.3.17Upgrade to PostgreSQL version 9.5.7 | May 15, 2017 | May 12, 2017 |
| Redhat_linux | — | Upgrade postgresql-debuginfoUpgrade postgresql-serverNo solution existsUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-upgrade | Aug 6, 2017 | May 12, 2017 |
| Suse | — | Upgrade postgresql10-docsUpgrade postgresql94-develUpgrade postgresql94-serverUpgrade postgresql93-serverUpgrade postgresql93-docsUpgrade postgresql96Upgrade postgresql10-plpythonUpgrade postgresql94Upgrade postgresql96-serverUpgrade postgresql10-pltclUpgrade postgresql93Upgrade postgresql96-contribUpgrade postgresql94-contribUpgrade postgresql10-plperlUpgrade postgresql96-docsUpgrade postgresql94-docsUpgrade postgresql10Upgrade postgresql93-contribUpgrade libpq5-32bitUpgrade postgresql10-serverUpgrade postgresql10-contribUpgrade libecpg6Upgrade libpq5Upgrade postgresql10-develUpgrade postgresql96-devel | May 31, 2017 | May 12, 2017 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-9.6Upgrade postgresql-9.3 | Nov 19, 2024 | May 12, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub