PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresql | Aug 30, 2017 | May 12, 2017 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql92Upgrade postgresql93Upgrade postgresql94 | Jun 7, 2017 | May 12, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 12, 2017 |
| Centos_linux | — | Upgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-staticUpgrade postgresql-upgradeUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-docs | Aug 28, 2019 | May 12, 2017 |
| Debian | — | Upgrade postgresql-9.1Upgrade postgresql-9.6 | May 14, 2017 | May 12, 2017 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 30, 2017 | May 12, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-develUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-docs | Jan 18, 2018 | May 12, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade postgresql-contribUpgrade postgresql-libsUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-serverUpgrade postgresql-develUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-docs | Jan 18, 2018 | May 12, 2017 |
| Oracle_linux | — | Upgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-upgradeUpgrade postgresql-develUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-docs | Aug 8, 2017 | May 11, 2017 |
| Postgres | — | Upgrade to PostgreSQL version 9.3.17Upgrade to PostgreSQL version 9.5.7Upgrade to PostgreSQL version 9.4.12Upgrade to PostgreSQL version 9.2.21Upgrade to PostgreSQL version 9.6.3 | May 15, 2017 | May 12, 2017 |
| Redhat_linux | — | Upgrade postgresqlUpgrade postgresql-upgradeNo solution existsUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-serverUpgrade postgresql-debuginfoUpgrade postgresql-libs | Aug 6, 2017 | May 12, 2017 |
| Suse | — | Upgrade postgresql94-serverUpgrade postgresql10-serverUpgrade libpq5Upgrade postgresql93-serverUpgrade postgresql10-contribUpgrade postgresql93Upgrade postgresql93-contribUpgrade postgresql10Upgrade postgresql10-plpythonUpgrade postgresql96-contribUpgrade postgresql94-develUpgrade postgresql93-docsUpgrade postgresql94Upgrade postgresql96Upgrade postgresql96-docsUpgrade postgresql96-develUpgrade postgresql96-serverUpgrade libecpg6Upgrade postgresql10-pltclUpgrade postgresql10-develUpgrade postgresql10-docsUpgrade postgresql94-docsUpgrade libpq5-32bitUpgrade postgresql94-contribUpgrade postgresql10-plperl | May 31, 2017 | May 12, 2017 |
| Ubuntu | — | Upgrade postgresql-9.3Upgrade postgresql-9.6Upgrade postgresql-9.5 | Nov 19, 2024 | May 12, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub