PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresql | Sep 20, 2017 | Aug 16, 2017 |
| Amazon_linux | — | Upgrade postgresql96Upgrade postgresql92Upgrade postgresql95Upgrade postgresql94Upgrade postgresql93 | Sep 1, 2017 | Aug 10, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 16, 2017 |
| Centos_linux | — | Upgrade postgresql-testUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-upgradeUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-debuginfoUpgrade postgresql-devel | Sep 15, 2017 | Aug 10, 2017 |
| Debian | — | Upgrade postgresql-9.6Upgrade postgresql-9.1 | Aug 12, 2017 | Aug 10, 2017 |
| Freebsd | — | Upgrade postgresql96-serverUpgrade postgresql95-serverUpgrade postgresql94-serverUpgrade postgresql92-serverUpgrade postgresql93-server | Aug 10, 2017 | Aug 10, 2017 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 30, 2017 | Aug 16, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-plpythonUpgrade postgresql-test | Nov 30, 2017 | Aug 16, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade postgresqlUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-contrib | Nov 30, 2017 | Aug 16, 2017 |
| Oracle_linux | — | Upgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-plpythonUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-static | Sep 15, 2017 | Aug 10, 2017 |
| Postgres | — | Upgrade to PostgreSQL version 9.6.4 | Aug 17, 2017 | Aug 16, 2017 |
| Redhat_linux | — | Upgrade postgresql-upgradeUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-devel | Oct 4, 2017 | Aug 10, 2017 |
| Suse | — | Upgrade postgresql10-serverUpgrade postgresql94-docsUpgrade postgresql96Upgrade postgresql96-serverUpgrade postgresql94-contribUpgrade postgresql10Upgrade postgresql94Upgrade postgresql93-contribUpgrade libpq5-32bitUpgrade postgresql10-contribUpgrade libpq5Upgrade postgresql96-develUpgrade postgresql10-pltclUpgrade postgresql94-serverUpgrade postgresql10-develUpgrade postgresql96-contribUpgrade postgresql94-develUpgrade libecpg6Upgrade postgresql10-plpythonUpgrade postgresql96-docsUpgrade postgresql93Upgrade postgresql93-docsUpgrade postgresql93-serverUpgrade postgresql10-plperlUpgrade postgresql10-docs | Aug 23, 2017 | Aug 10, 2017 |
| Ubuntu | — | Upgrade postgresql-9.3Upgrade postgresql-9.6Upgrade postgresql-9.5 | Aug 15, 2017 | Aug 10, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub