PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresql | Sep 20, 2017 | Aug 16, 2017 |
| Amazon_linux | — | Upgrade postgresql93Upgrade postgresql95Upgrade postgresql96Upgrade postgresql94Upgrade postgresql92 | Sep 1, 2017 | Aug 10, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 16, 2017 |
| Centos_linux | — | Upgrade postgresql-staticUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-debuginfoUpgrade postgresql-develUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-plpythonUpgrade postgresql-contrib | Sep 15, 2017 | Aug 10, 2017 |
| Debian | — | Upgrade postgresql-9.1Upgrade postgresql-9.6 | Aug 12, 2017 | Aug 10, 2017 |
| Freebsd | — | Upgrade postgresql93-serverUpgrade postgresql95-serverUpgrade postgresql92-serverUpgrade postgresql94-serverUpgrade postgresql96-server | Aug 10, 2017 | Aug 10, 2017 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 30, 2017 | Aug 16, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-plpython | Nov 30, 2017 | Aug 16, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-server | Nov 30, 2017 | Aug 16, 2017 |
| Oracle_linux | — | Upgrade postgresql-develUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-libsUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-pltcl | Sep 15, 2017 | Aug 10, 2017 |
| Postgres | — | Upgrade to PostgreSQL version 9.6.4 | Aug 17, 2017 | Aug 16, 2017 |
| Redhat_linux | — | Upgrade postgresql-serverUpgrade postgresql-upgradeUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-devel | Oct 4, 2017 | Aug 10, 2017 |
| Suse | — | Upgrade postgresql96-contribUpgrade postgresql10-docsUpgrade postgresql10-develUpgrade postgresql93-serverUpgrade postgresql10-plperlUpgrade postgresql10-plpythonUpgrade libecpg6Upgrade postgresql10-pltclUpgrade postgresql93-docsUpgrade postgresql93Upgrade postgresql96-develUpgrade postgresql94-develUpgrade postgresql96-docsUpgrade postgresql94-serverUpgrade postgresql10Upgrade postgresql94-contribUpgrade postgresql94Upgrade postgresql93-contribUpgrade postgresql10-contribUpgrade postgresql96-serverUpgrade postgresql10-serverUpgrade libpq5-32bitUpgrade libpq5Upgrade postgresql94-docsUpgrade postgresql96 | Aug 23, 2017 | Aug 10, 2017 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-9.6Upgrade postgresql-9.3 | Aug 15, 2017 | Aug 10, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub