PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresql | Sep 20, 2017 | Aug 16, 2017 |
| Amazon_linux | — | Upgrade postgresql93Upgrade postgresql95Upgrade postgresql94Upgrade postgresql96Upgrade postgresql92 | Sep 1, 2017 | Aug 10, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 16, 2017 |
| Centos_linux | — | Upgrade postgresql-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-test | Sep 15, 2017 | Aug 10, 2017 |
| Debian | — | Upgrade postgresql-9.1Upgrade postgresql-9.6 | Aug 12, 2017 | Aug 10, 2017 |
| Freebsd | — | Upgrade postgresql94-serverUpgrade postgresql92-serverUpgrade postgresql93-serverUpgrade postgresql95-serverUpgrade postgresql96-server | Aug 10, 2017 | Aug 10, 2017 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 30, 2017 | Aug 16, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-plpython | Nov 30, 2017 | Aug 16, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-plperl | Nov 30, 2017 | Aug 16, 2017 |
| Oracle_linux | — | Upgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-upgradeUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresql-libs | Sep 15, 2017 | Aug 10, 2017 |
| Postgres | — | Upgrade to PostgreSQL version 9.6.4 | Aug 17, 2017 | Aug 16, 2017 |
| Redhat_linux | — | Upgrade postgresql-staticUpgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-develUpgrade postgresql-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-contrib | Oct 4, 2017 | Aug 10, 2017 |
| Suse | — | Upgrade postgresql96-contribUpgrade postgresql10-develUpgrade postgresql10-plperlUpgrade postgresql94-serverUpgrade postgresql93Upgrade postgresql93-docsUpgrade postgresql96-develUpgrade postgresql10-pltclUpgrade postgresql10-plpythonUpgrade postgresql94-develUpgrade libecpg6Upgrade postgresql93-serverUpgrade postgresql96-docsUpgrade postgresql10-docsUpgrade postgresql10-serverUpgrade postgresql10-contribUpgrade postgresql94Upgrade postgresql94-contribUpgrade postgresql94-docsUpgrade postgresql93-contribUpgrade libpq5Upgrade libpq5-32bitUpgrade postgresql96Upgrade postgresql10Upgrade postgresql96-server | Aug 23, 2017 | Aug 10, 2017 |
| Ubuntu | — | Upgrade postgresql-9.3Upgrade postgresql-9.5Upgrade postgresql-9.6 | Aug 15, 2017 | Aug 10, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub