PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql14Upgrade postgresql15 | Sep 20, 2017 | Aug 16, 2017 |
| Amazon_linux | — | Upgrade postgresql93Upgrade postgresql96Upgrade postgresql92Upgrade postgresql95Upgrade postgresql94 | Sep 1, 2017 | Aug 10, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 16, 2017 |
| Centos_linux | — | Upgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-debuginfoUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-docs | Sep 15, 2017 | Aug 10, 2017 |
| Debian | — | Upgrade postgresql-9.1Upgrade postgresql-9.6 | Aug 12, 2017 | Aug 10, 2017 |
| Freebsd | — | Upgrade postgresql96-serverUpgrade postgresql93-serverUpgrade postgresql94-serverUpgrade postgresql95-serverUpgrade postgresql92-server | Aug 10, 2017 | Aug 10, 2017 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 30, 2017 | Aug 16, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-plpythonUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-devel | Nov 30, 2017 | Aug 16, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresql-docs | Nov 30, 2017 | Aug 16, 2017 |
| Oracle_linux | — | Upgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-testUpgrade postgresql-plpythonUpgrade postgresql-upgradeUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresql | Sep 15, 2017 | Aug 10, 2017 |
| Postgres | — | Upgrade to PostgreSQL version 9.6.4 | Aug 17, 2017 | Aug 16, 2017 |
| Redhat_linux | — | Upgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-develUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresql-static | Oct 4, 2017 | Aug 10, 2017 |
| Suse | — | Upgrade postgresql93-serverUpgrade postgresql10-plpythonUpgrade libecpg6Upgrade postgresql94-develUpgrade postgresql93-docsUpgrade postgresql96-contribUpgrade postgresql10-develUpgrade postgresql94-serverUpgrade postgresql93Upgrade postgresql96-docsUpgrade postgresql10-docsUpgrade postgresql10-plperlUpgrade postgresql96-develUpgrade postgresql10-pltclUpgrade postgresql93-contribUpgrade postgresql94-contribUpgrade postgresql94-docsUpgrade postgresql10Upgrade postgresql96-serverUpgrade postgresql10-serverUpgrade postgresql10-contribUpgrade libpq5-32bitUpgrade libpq5Upgrade postgresql96Upgrade postgresql94 | Aug 23, 2017 | Aug 10, 2017 |
| Ubuntu | — | Upgrade postgresql-9.3Upgrade postgresql-9.5Upgrade postgresql-9.6 | Aug 15, 2017 | Aug 10, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub