Vulnerability-Lookup

Vulnerability from cleanstart

Published

2026-01-30 17:19

Modified

2026-01-29 18:58

Summary

vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT

Details

Multiple security vulnerabilities affect the postgresql package. A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. See references for individual vulnerability details.

Severity

9.8 (Critical)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2017-15098	WEB
	https://osv.dev/vulnerability/CVE-2017-15099	WEB
	https://osv.dev/vulnerability/CVE-2017-7484	WEB
	https://osv.dev/vulnerability/CVE-2017-7485	WEB
	https://osv.dev/vulnerability/CVE-2017-7486	WEB
	https://osv.dev/vulnerability/CVE-2017-7546	WEB
	https://osv.dev/vulnerability/CVE-2017-7547	WEB
	https://osv.dev/vulnerability/CVE-2017-7548	WEB
	https://osv.dev/vulnerability/CVE-2018-1052	WEB
	https://osv.dev/vulnerability/CVE-2018-1058	WEB
	https://osv.dev/vulnerability/CVE-2018-16850	WEB
	https://osv.dev/vulnerability/CVE-2019-10129	WEB
	https://osv.dev/vulnerability/CVE-2019-10130	WEB
	https://osv.dev/vulnerability/CVE-2019-10208	WEB
	https://osv.dev/vulnerability/CVE-2019-10209	WEB
	https://osv.dev/vulnerability/CVE-2020-14349	WEB
	https://osv.dev/vulnerability/CVE-2020-14350	WEB
	https://osv.dev/vulnerability/CVE-2020-25694	WEB
	https://osv.dev/vulnerability/CVE-2020-25695	WEB
	https://osv.dev/vulnerability/CVE-2020-25696	WEB
	https://osv.dev/vulnerability/CVE-2021-20229	WEB
	https://osv.dev/vulnerability/CVE-2021-23214	WEB
	https://osv.dev/vulnerability/CVE-2021-32027	WEB
	https://osv.dev/vulnerability/CVE-2021-32028	WEB
	https://osv.dev/vulnerability/CVE-2021-32029	WEB
	https://osv.dev/vulnerability/CVE-2021-3393	WEB
	https://osv.dev/vulnerability/CVE-2021-3677	WEB
	https://osv.dev/vulnerability/CVE-2022-2625	WEB
	https://osv.dev/vulnerability/CVE-2022-41862	WEB
	https://osv.dev/vulnerability/CVE-2023-2454	WEB
	https://osv.dev/vulnerability/CVE-2023-2455	WEB
	https://osv.dev/vulnerability/CVE-2023-39418	WEB
	https://osv.dev/vulnerability/CVE-2023-5870	WEB
	https://osv.dev/vulnerability/CVE-2024-7348	WEB
	https://osv.dev/vulnerability/CVE-2025-51476	WEB
	https://osv.dev/vulnerability/CVE-2025-51477	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2017-15098	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2017-15099	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2017-7484	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2017-7485	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2017-7486	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2017-7546	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2017-7547	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2017-7548	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2018-1052	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2018-1058	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2018-16850	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2019-10129	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2019-10130	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2019-10208	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2019-10209	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2020-14349	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2020-14350	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2020-25694	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2020-25695	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2020-25696	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2021-20229	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2021-23214	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2021-32027	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2021-32028	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2021-32029	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2021-3393	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2021-3677	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2022-2625	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2022-41862	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2023-2454	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2023-2455	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2023-39418	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2023-5870	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2024-7348	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2025-51476	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2025-51477	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "postgresql"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.6.4-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Multiple security vulnerabilities affect the postgresql package. A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. See references for individual vulnerability details.",
  "id": "CLEANSTART-2026-FW42039",
  "modified": "2026-01-29T18:58:54Z",
  "published": "2026-01-30T17:19:56.954092Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-FW42039"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2017-15098"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2017-15099"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2017-7484"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2017-7485"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2017-7486"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2017-7546"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2017-7547"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2017-7548"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2018-1052"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2018-1058"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2018-16850"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2019-10129"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2019-10130"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2019-10208"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2019-10209"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2020-14349"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2020-14350"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2020-25694"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2020-25695"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2020-25696"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2021-20229"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2021-23214"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2021-32027"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2021-32028"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2021-32029"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2021-3393"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2021-3677"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2022-2625"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2022-41862"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2023-2454"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2023-2455"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2023-39418"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2023-5870"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2024-7348"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2025-51476"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2025-51477"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15098"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15099"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7484"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7485"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7486"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7546"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7547"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7548"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1052"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1058"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16850"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10129"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10130"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10208"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10209"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14349"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14350"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25694"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25695"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25696"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20229"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23214"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32027"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32028"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32029"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3393"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3677"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2625"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41862"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2454"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2455"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39418"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5870"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7348"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51476"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51477"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT",
  "upstream": [
    "CVE-2017-15098",
    "CVE-2017-15099",
    "CVE-2017-7484",
    "CVE-2017-7485",
    "CVE-2017-7486",
    "CVE-2017-7546",
    "CVE-2017-7547",
    "CVE-2017-7548",
    "CVE-2018-1052",
    "CVE-2018-1058",
    "CVE-2018-16850",
    "CVE-2019-10129",
    "CVE-2019-10130",
    "CVE-2019-10208",
    "CVE-2019-10209",
    "CVE-2020-14349",
    "CVE-2020-14350",
    "CVE-2020-25694",
    "CVE-2020-25695",
    "CVE-2020-25696",
    "CVE-2021-20229",
    "CVE-2021-23214",
    "CVE-2021-32027",
    "CVE-2021-32028",
    "CVE-2021-32029",
    "CVE-2021-3393",
    "CVE-2021-3677",
    "CVE-2022-2625",
    "CVE-2022-41862",
    "CVE-2023-2454",
    "CVE-2023-2455",
    "CVE-2023-39418",
    "CVE-2023-5870",
    "CVE-2024-7348",
    "CVE-2025-51476",
    "CVE-2025-51477"
  ]
}

CVE-2017-15098 (GCVE-0-2017-15098)

Vulnerability from cvelistv5 – Published: 2017-11-22 17:00 – Updated: 2024-09-16 23:10

Summary

Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.

Severity

No CVSS data available.

CWE

CWE-200

Assigner

redhat

References

8 references

URL	Tags
http://www.securityfocus.com/bid/101781	vdb-entryx_refsource_BID
https://www.debian.org/security/2017/dsa-4027	vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2018:2511	vendor-advisoryx_refsource_REDHAT
https://www.postgresql.org/support/security/	x_refsource_MISC
http://www.securitytracker.com/id/1039752	vdb-entryx_refsource_SECTRACK
https://www.postgresql.org/about/news/1801/	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:2566	vendor-advisoryx_refsource_REDHAT
https://www.debian.org/security/2017/dsa-4028	vendor-advisoryx_refsource_DEBIAN

Impacted products

1 product

Vendor	Product	Version
Red Hat, Inc.	postgresql	Affected: 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20

Date Public

2017-11-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:50:14.965Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "101781",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/101781"
          },
          {
            "name": "DSA-4027",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-4027"
          },
          {
            "name": "RHSA-2018:2511",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2511"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.postgresql.org/support/security/"
          },
          {
            "name": "1039752",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1039752"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.postgresql.org/about/news/1801/"
          },
          {
            "name": "RHSA-2018:2566",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2566"
          },
          {
            "name": "DSA-4028",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-4028"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "postgresql",
          "vendor": "Red Hat, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20"
            }
          ]
        }
      ],
      "datePublic": "2017-11-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-08-28T09:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "101781",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/101781"
        },
        {
          "name": "DSA-4027",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-4027"
        },
        {
          "name": "RHSA-2018:2511",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2511"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.postgresql.org/support/security/"
        },
        {
          "name": "1039752",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1039752"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.postgresql.org/about/news/1801/"
        },
        {
          "name": "RHSA-2018:2566",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2566"
        },
        {
          "name": "DSA-4028",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-4028"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "DATE_PUBLIC": "2017-11-09T00:00:00",
          "ID": "CVE-2017-15098",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "postgresql",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Red Hat, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "101781",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/101781"
            },
            {
              "name": "DSA-4027",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2017/dsa-4027"
            },
            {
              "name": "RHSA-2018:2511",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2511"
            },
            {
              "name": "https://www.postgresql.org/support/security/",
              "refsource": "MISC",
              "url": "https://www.postgresql.org/support/security/"
            },
            {
              "name": "1039752",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1039752"
            },
            {
              "name": "https://www.postgresql.org/about/news/1801/",
              "refsource": "CONFIRM",
              "url": "https://www.postgresql.org/about/news/1801/"
            },
            {
              "name": "RHSA-2018:2566",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2566"
            },
            {
              "name": "DSA-4028",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2017/dsa-4028"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2017-15098",
    "datePublished": "2017-11-22T17:00:00.000Z",
    "dateReserved": "2017-10-08T00:00:00.000Z",
    "dateUpdated": "2024-09-16T23:10:51.250Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-15099 (GCVE-0-2017-15099)

Vulnerability from cvelistv5 – Published: 2017-11-22 18:00 – Updated: 2024-09-16 16:43

Summary

INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.

Severity

No CVSS data available.

CWE

CWE-200

Assigner

redhat

References

7 references

URL	Tags
http://www.securityfocus.com/bid/101781	vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHSA-2018:2511	vendor-advisoryx_refsource_REDHAT
https://www.postgresql.org/support/security/	x_refsource_MISC
http://www.securitytracker.com/id/1039752	vdb-entryx_refsource_SECTRACK
https://www.postgresql.org/about/news/1801/	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:2566	vendor-advisoryx_refsource_REDHAT
https://www.debian.org/security/2017/dsa-4028	vendor-advisoryx_refsource_DEBIAN

Impacted products

1 product

Vendor	Product	Version
Red Hat, Inc.	postgresql	Affected: 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10

Date Public

2017-11-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:50:16.128Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "101781",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/101781"
          },
          {
            "name": "RHSA-2018:2511",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2511"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.postgresql.org/support/security/"
          },
          {
            "name": "1039752",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1039752"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.postgresql.org/about/news/1801/"
          },
          {
            "name": "RHSA-2018:2566",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2566"
          },
          {
            "name": "DSA-4028",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-4028"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "postgresql",
          "vendor": "Red Hat, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10"
            }
          ]
        }
      ],
      "datePublic": "2017-11-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-08-28T09:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "101781",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/101781"
        },
        {
          "name": "RHSA-2018:2511",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2511"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.postgresql.org/support/security/"
        },
        {
          "name": "1039752",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1039752"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.postgresql.org/about/news/1801/"
        },
        {
          "name": "RHSA-2018:2566",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2566"
        },
        {
          "name": "DSA-4028",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-4028"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "DATE_PUBLIC": "2017-11-09T00:00:00",
          "ID": "CVE-2017-15099",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "postgresql",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Red Hat, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "101781",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/101781"
            },
            {
              "name": "RHSA-2018:2511",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2511"
            },
            {
              "name": "https://www.postgresql.org/support/security/",
              "refsource": "MISC",
              "url": "https://www.postgresql.org/support/security/"
            },
            {
              "name": "1039752",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1039752"
            },
            {
              "name": "https://www.postgresql.org/about/news/1801/",
              "refsource": "CONFIRM",
              "url": "https://www.postgresql.org/about/news/1801/"
            },
            {
              "name": "RHSA-2018:2566",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2566"
            },
            {
              "name": "DSA-4028",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2017/dsa-4028"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2017-15099",
    "datePublished": "2017-11-22T18:00:00.000Z",
    "dateReserved": "2017-10-08T00:00:00.000Z",
    "dateUpdated": "2024-09-16T16:43:27.924Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7484 (GCVE-0-2017-7484)

Vulnerability from cvelistv5 – Published: 2017-05-12 19:00 – Updated: 2024-08-05 16:04

Summary

It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access.

Severity

No CVSS data available.

CWE

CWE-285

Assigner

redhat

References

10 references

URL	Tags
http://www.securitytracker.com/id/1038476	vdb-entryx_refsource_SECTRACK
http://www.debian.org/security/2017/dsa-3851	vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2017:2425	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1678	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1677	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1983	vendor-advisoryx_refsource_REDHAT
https://www.postgresql.org/about/news/1746/	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2017:1838	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/98459	vdb-entryx_refsource_BID
https://security.gentoo.org/glsa/201710-06	vendor-advisoryx_refsource_GENTOO

Impacted products

1 product

Vendor	Product	Version
The PostgreSQL Global Development Group	PostgreSQL	Affected: 9.2 - 9.6

Date Public

2017-05-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:04:11.415Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1038476",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038476"
          },
          {
            "name": "DSA-3851",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3851"
          },
          {
            "name": "RHSA-2017:2425",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2425"
          },
          {
            "name": "RHSA-2017:1678",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1678"
          },
          {
            "name": "RHSA-2017:1677",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1677"
          },
          {
            "name": "RHSA-2017:1983",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1983"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.postgresql.org/about/news/1746/"
          },
          {
            "name": "RHSA-2017:1838",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1838"
          },
          {
            "name": "98459",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/98459"
          },
          {
            "name": "GLSA-201710-06",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201710-06"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PostgreSQL",
          "vendor": "The PostgreSQL Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "9.2 - 9.6"
            }
          ]
        }
      ],
      "datePublic": "2017-05-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "1038476",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038476"
        },
        {
          "name": "DSA-3851",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3851"
        },
        {
          "name": "RHSA-2017:2425",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2425"
        },
        {
          "name": "RHSA-2017:1678",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1678"
        },
        {
          "name": "RHSA-2017:1677",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1677"
        },
        {
          "name": "RHSA-2017:1983",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1983"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.postgresql.org/about/news/1746/"
        },
        {
          "name": "RHSA-2017:1838",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1838"
        },
        {
          "name": "98459",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/98459"
        },
        {
          "name": "GLSA-201710-06",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201710-06"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2017-7484",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PostgreSQL",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "9.2 - 9.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "The PostgreSQL Global Development Group"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1038476",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038476"
            },
            {
              "name": "DSA-3851",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3851"
            },
            {
              "name": "RHSA-2017:2425",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2425"
            },
            {
              "name": "RHSA-2017:1678",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1678"
            },
            {
              "name": "RHSA-2017:1677",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1677"
            },
            {
              "name": "RHSA-2017:1983",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1983"
            },
            {
              "name": "https://www.postgresql.org/about/news/1746/",
              "refsource": "CONFIRM",
              "url": "https://www.postgresql.org/about/news/1746/"
            },
            {
              "name": "RHSA-2017:1838",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1838"
            },
            {
              "name": "98459",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/98459"
            },
            {
              "name": "GLSA-201710-06",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201710-06"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2017-7484",
    "datePublished": "2017-05-12T19:00:00.000Z",
    "dateReserved": "2017-04-05T00:00:00.000Z",
    "dateUpdated": "2024-08-05T16:04:11.415Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7485 (GCVE-0-2017-7485)

Vulnerability from cvelistv5 – Published: 2017-05-12 19:00 – Updated: 2024-08-05 16:04

Summary

In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.

Severity

No CVSS data available.

CWE

CWE-390

Assigner

redhat

References

9 references

URL	Tags
http://www.securitytracker.com/id/1038476	vdb-entryx_refsource_SECTRACK
http://www.debian.org/security/2017/dsa-3851	vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2017:2425	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1678	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1677	vendor-advisoryx_refsource_REDHAT
https://www.postgresql.org/about/news/1746/	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2017:1838	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/98461	vdb-entryx_refsource_BID
https://security.gentoo.org/glsa/201710-06	vendor-advisoryx_refsource_GENTOO

Impacted products

1 product

Vendor	Product	Version
The PostgreSQL Global Development Group	PostgreSQL	Affected: 9.3 - 9.6

Date Public

2017-05-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:04:11.584Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1038476",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038476"
          },
          {
            "name": "DSA-3851",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3851"
          },
          {
            "name": "RHSA-2017:2425",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2425"
          },
          {
            "name": "RHSA-2017:1678",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1678"
          },
          {
            "name": "RHSA-2017:1677",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1677"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.postgresql.org/about/news/1746/"
          },
          {
            "name": "RHSA-2017:1838",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1838"
          },
          {
            "name": "98461",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/98461"
          },
          {
            "name": "GLSA-201710-06",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201710-06"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PostgreSQL",
          "vendor": "The PostgreSQL Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "9.3 - 9.6"
            }
          ]
        }
      ],
      "datePublic": "2017-05-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-390",
              "description": "CWE-390",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "1038476",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038476"
        },
        {
          "name": "DSA-3851",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3851"
        },
        {
          "name": "RHSA-2017:2425",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2425"
        },
        {
          "name": "RHSA-2017:1678",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1678"
        },
        {
          "name": "RHSA-2017:1677",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1677"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.postgresql.org/about/news/1746/"
        },
        {
          "name": "RHSA-2017:1838",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1838"
        },
        {
          "name": "98461",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/98461"
        },
        {
          "name": "GLSA-201710-06",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201710-06"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2017-7485",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PostgreSQL",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "9.3 - 9.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "The PostgreSQL Global Development Group"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-390"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1038476",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038476"
            },
            {
              "name": "DSA-3851",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3851"
            },
            {
              "name": "RHSA-2017:2425",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2425"
            },
            {
              "name": "RHSA-2017:1678",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1678"
            },
            {
              "name": "RHSA-2017:1677",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1677"
            },
            {
              "name": "https://www.postgresql.org/about/news/1746/",
              "refsource": "CONFIRM",
              "url": "https://www.postgresql.org/about/news/1746/"
            },
            {
              "name": "RHSA-2017:1838",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1838"
            },
            {
              "name": "98461",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/98461"
            },
            {
              "name": "GLSA-201710-06",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201710-06"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2017-7485",
    "datePublished": "2017-05-12T19:00:00.000Z",
    "dateReserved": "2017-04-05T00:00:00.000Z",
    "dateUpdated": "2024-08-05T16:04:11.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7486 (GCVE-0-2017-7486)

Vulnerability from cvelistv5 – Published: 2017-05-12 19:00 – Updated: 2024-08-05 16:04

Summary

PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.

Severity

No CVSS data available.

CWE

CWE-522

Assigner

redhat

References

10 references

URL	Tags
http://www.securitytracker.com/id/1038476	vdb-entryx_refsource_SECTRACK
http://www.debian.org/security/2017/dsa-3851	vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2017:2425	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1678	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1677	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1983	vendor-advisoryx_refsource_REDHAT
https://www.postgresql.org/about/news/1746/	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2017:1838	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/98460	vdb-entryx_refsource_BID
https://security.gentoo.org/glsa/201710-06	vendor-advisoryx_refsource_GENTOO

Impacted products

1 product

Vendor	Product	Version
The PostgreSQL Global Development Group	PostgreSQL	Affected: 8.4 - 9.6

Date Public

2017-05-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:04:11.547Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1038476",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038476"
          },
          {
            "name": "DSA-3851",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3851"
          },
          {
            "name": "RHSA-2017:2425",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2425"
          },
          {
            "name": "RHSA-2017:1678",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1678"
          },
          {
            "name": "RHSA-2017:1677",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1677"
          },
          {
            "name": "RHSA-2017:1983",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1983"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.postgresql.org/about/news/1746/"
          },
          {
            "name": "RHSA-2017:1838",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1838"
          },
          {
            "name": "98460",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/98460"
          },
          {
            "name": "GLSA-201710-06",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201710-06"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PostgreSQL",
          "vendor": "The PostgreSQL Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "8.4 - 9.6"
            }
          ]
        }
      ],
      "datePublic": "2017-05-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "1038476",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038476"
        },
        {
          "name": "DSA-3851",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3851"
        },
        {
          "name": "RHSA-2017:2425",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2425"
        },
        {
          "name": "RHSA-2017:1678",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1678"
        },
        {
          "name": "RHSA-2017:1677",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1677"
        },
        {
          "name": "RHSA-2017:1983",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1983"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.postgresql.org/about/news/1746/"
        },
        {
          "name": "RHSA-2017:1838",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1838"
        },
        {
          "name": "98460",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/98460"
        },
        {
          "name": "GLSA-201710-06",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201710-06"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2017-7486",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PostgreSQL",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "8.4 - 9.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "The PostgreSQL Global Development Group"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-522"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1038476",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038476"
            },
            {
              "name": "DSA-3851",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3851"
            },
            {
              "name": "RHSA-2017:2425",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2425"
            },
            {
              "name": "RHSA-2017:1678",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1678"
            },
            {
              "name": "RHSA-2017:1677",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1677"
            },
            {
              "name": "RHSA-2017:1983",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1983"
            },
            {
              "name": "https://www.postgresql.org/about/news/1746/",
              "refsource": "CONFIRM",
              "url": "https://www.postgresql.org/about/news/1746/"
            },
            {
              "name": "RHSA-2017:1838",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1838"
            },
            {
              "name": "98460",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/98460"
            },
            {
              "name": "GLSA-201710-06",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201710-06"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2017-7486",
    "datePublished": "2017-05-12T19:00:00.000Z",
    "dateReserved": "2017-04-05T00:00:00.000Z",
    "dateUpdated": "2024-08-05T16:04:11.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7546 (GCVE-0-2017-7546)

Vulnerability from cvelistv5 – Published: 2017-08-16 18:00 – Updated: 2024-09-16 17:18

Summary

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.

Severity

No CVSS data available.

CWE

CWE-287

Assigner

redhat

References

10 references

URL	Tags
https://access.redhat.com/errata/RHSA-2017:2728	vendor-advisoryx_refsource_REDHAT
http://www.debian.org/security/2017/dsa-3936	vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2017:2678	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:2860	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/100278	vdb-entryx_refsource_BID
http://www.debian.org/security/2017/dsa-3935	vendor-advisoryx_refsource_DEBIAN
http://www.securitytracker.com/id/1039142	vdb-entryx_refsource_SECTRACK
https://www.postgresql.org/about/news/1772/	x_refsource_CONFIRM
https://security.gentoo.org/glsa/201710-06	vendor-advisoryx_refsource_GENTOO
https://access.redhat.com/errata/RHSA-2017:2677	vendor-advisoryx_refsource_REDHAT

Impacted products

1 product

Vendor	Product	Version
PostgreSQL	postgresql	Affected: 9.2.x before 9.2.22 Affected: 9.3.x before 9.3.18 Affected: 9.4.x before 9.4.13 Affected: 9.5.x before 9.5.8 Affected: 9.6.x before 9.6.4

Date Public

2017-08-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:04:12.029Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2017:2728",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2728"
          },
          {
            "name": "DSA-3936",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3936"
          },
          {
            "name": "RHSA-2017:2678",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2678"
          },
          {
            "name": "RHSA-2017:2860",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2860"
          },
          {
            "name": "100278",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100278"
          },
          {
            "name": "DSA-3935",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3935"
          },
          {
            "name": "1039142",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1039142"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.postgresql.org/about/news/1772/"
          },
          {
            "name": "GLSA-201710-06",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201710-06"
          },
          {
            "name": "RHSA-2017:2677",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2677"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "postgresql",
          "vendor": "PostgreSQL",
          "versions": [
            {
              "status": "affected",
              "version": "9.2.x before 9.2.22"
            },
            {
              "status": "affected",
              "version": "9.3.x before 9.3.18"
            },
            {
              "status": "affected",
              "version": "9.4.x before 9.4.13"
            },
            {
              "status": "affected",
              "version": "9.5.x before 9.5.8"
            },
            {
              "status": "affected",
              "version": "9.6.x before 9.6.4"
            }
          ]
        }
      ],
      "datePublic": "2017-08-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-30T10:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2017:2728",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2728"
        },
        {
          "name": "DSA-3936",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3936"
        },
        {
          "name": "RHSA-2017:2678",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2678"
        },
        {
          "name": "RHSA-2017:2860",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2860"
        },
        {
          "name": "100278",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/100278"
        },
        {
          "name": "DSA-3935",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3935"
        },
        {
          "name": "1039142",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1039142"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.postgresql.org/about/news/1772/"
        },
        {
          "name": "GLSA-201710-06",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201710-06"
        },
        {
          "name": "RHSA-2017:2677",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2677"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "DATE_PUBLIC": "2017-08-10T00:00:00",
          "ID": "CVE-2017-7546",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "postgresql",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "9.2.x before 9.2.22"
                          },
                          {
                            "version_value": "9.3.x before 9.3.18"
                          },
                          {
                            "version_value": "9.4.x before 9.4.13"
                          },
                          {
                            "version_value": "9.5.x before 9.5.8"
                          },
                          {
                            "version_value": "9.6.x before 9.6.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "PostgreSQL"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-287"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2017:2728",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2728"
            },
            {
              "name": "DSA-3936",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3936"
            },
            {
              "name": "RHSA-2017:2678",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2678"
            },
            {
              "name": "RHSA-2017:2860",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2860"
            },
            {
              "name": "100278",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/100278"
            },
            {
              "name": "DSA-3935",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3935"
            },
            {
              "name": "1039142",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1039142"
            },
            {
              "name": "https://www.postgresql.org/about/news/1772/",
              "refsource": "CONFIRM",
              "url": "https://www.postgresql.org/about/news/1772/"
            },
            {
              "name": "GLSA-201710-06",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201710-06"
            },
            {
              "name": "RHSA-2017:2677",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2677"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2017-7546",
    "datePublished": "2017-08-16T18:00:00.000Z",
    "dateReserved": "2017-04-05T00:00:00.000Z",
    "dateUpdated": "2024-09-16T17:18:53.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7547 (GCVE-0-2017-7547)

Vulnerability from cvelistv5 – Published: 2017-08-16 18:00 – Updated: 2024-09-16 23:41

Summary

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so.

Severity

No CVSS data available.

CWE

CWE-522

Assigner

redhat

References

9 references

URL	Tags
https://access.redhat.com/errata/RHSA-2017:2728	vendor-advisoryx_refsource_REDHAT
http://www.debian.org/security/2017/dsa-3936	vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2017:2678	vendor-advisoryx_refsource_REDHAT
http://www.debian.org/security/2017/dsa-3935	vendor-advisoryx_refsource_DEBIAN
http://www.securitytracker.com/id/1039142	vdb-entryx_refsource_SECTRACK
https://www.postgresql.org/about/news/1772/	x_refsource_CONFIRM
https://security.gentoo.org/glsa/201710-06	vendor-advisoryx_refsource_GENTOO
http://www.securityfocus.com/bid/100275	vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHSA-2017:2677	vendor-advisoryx_refsource_REDHAT

Impacted products

1 product

Vendor	Product	Version
PostgreSQL	postgresql	Affected: 9.2.x before 9.2.22 Affected: 9.3.x before 9.3.18 Affected: 9.4.x before 9.4.13 Affected: 9.5.x before 9.5.8 Affected: 9.6.x before 9.6.4

Date Public

2017-08-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:04:11.996Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2017:2728",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2728"
          },
          {
            "name": "DSA-3936",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3936"
          },
          {
            "name": "RHSA-2017:2678",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2678"
          },
          {
            "name": "DSA-3935",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3935"
          },
          {
            "name": "1039142",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1039142"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.postgresql.org/about/news/1772/"
          },
          {
            "name": "GLSA-201710-06",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201710-06"
          },
          {
            "name": "100275",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100275"
          },
          {
            "name": "RHSA-2017:2677",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2677"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "postgresql",
          "vendor": "PostgreSQL",
          "versions": [
            {
              "status": "affected",
              "version": "9.2.x before 9.2.22"
            },
            {
              "status": "affected",
              "version": "9.3.x before 9.3.18"
            },
            {
              "status": "affected",
              "version": "9.4.x before 9.4.13"
            },
            {
              "status": "affected",
              "version": "9.5.x before 9.5.8"
            },
            {
              "status": "affected",
              "version": "9.6.x before 9.6.4"
            }
          ]
        }
      ],
      "datePublic": "2017-08-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-30T10:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2017:2728",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2728"
        },
        {
          "name": "DSA-3936",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3936"
        },
        {
          "name": "RHSA-2017:2678",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2678"
        },
        {
          "name": "DSA-3935",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3935"
        },
        {
          "name": "1039142",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1039142"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.postgresql.org/about/news/1772/"
        },
        {
          "name": "GLSA-201710-06",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201710-06"
        },
        {
          "name": "100275",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/100275"
        },
        {
          "name": "RHSA-2017:2677",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2677"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "DATE_PUBLIC": "2017-08-10T00:00:00",
          "ID": "CVE-2017-7547",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "postgresql",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "9.2.x before 9.2.22"
                          },
                          {
                            "version_value": "9.3.x before 9.3.18"
                          },
                          {
                            "version_value": "9.4.x before 9.4.13"
                          },
                          {
                            "version_value": "9.5.x before 9.5.8"
                          },
                          {
                            "version_value": "9.6.x before 9.6.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "PostgreSQL"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-522"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2017:2728",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2728"
            },
            {
              "name": "DSA-3936",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3936"
            },
            {
              "name": "RHSA-2017:2678",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2678"
            },
            {
              "name": "DSA-3935",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3935"
            },
            {
              "name": "1039142",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1039142"
            },
            {
              "name": "https://www.postgresql.org/about/news/1772/",
              "refsource": "CONFIRM",
              "url": "https://www.postgresql.org/about/news/1772/"
            },
            {
              "name": "GLSA-201710-06",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201710-06"
            },
            {
              "name": "100275",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/100275"
            },
            {
              "name": "RHSA-2017:2677",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2677"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2017-7547",
    "datePublished": "2017-08-16T18:00:00.000Z",
    "dateReserved": "2017-04-05T00:00:00.000Z",
    "dateUpdated": "2024-09-16T23:41:38.650Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7548 (GCVE-0-2017-7548)

Vulnerability from cvelistv5 – Published: 2017-08-16 18:00 – Updated: 2024-09-16 16:18

Summary

PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.

Severity

No CVSS data available.

CWE

CWE-862

Assigner

redhat

References

8 references

URL	Tags
http://www.debian.org/security/2017/dsa-3936	vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2017:2678	vendor-advisoryx_refsource_REDHAT
http://www.debian.org/security/2017/dsa-3935	vendor-advisoryx_refsource_DEBIAN
http://www.securitytracker.com/id/1039142	vdb-entryx_refsource_SECTRACK
https://www.postgresql.org/about/news/1772/	x_refsource_CONFIRM
http://www.securityfocus.com/bid/100276	vdb-entryx_refsource_BID
https://security.gentoo.org/glsa/201710-06	vendor-advisoryx_refsource_GENTOO
https://access.redhat.com/errata/RHSA-2017:2677	vendor-advisoryx_refsource_REDHAT

Impacted products

1 product

Vendor	Product	Version
PostgreSQL	postgresql	Affected: 9.4.x before 9.4.13 Affected: 9.5.x before 9.5.8 Affected: 9.6.x before 9.6.4

Date Public

2017-08-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:04:12.013Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-3936",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3936"
          },
          {
            "name": "RHSA-2017:2678",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2678"
          },
          {
            "name": "DSA-3935",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3935"
          },
          {
            "name": "1039142",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1039142"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.postgresql.org/about/news/1772/"
          },
          {
            "name": "100276",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100276"
          },
          {
            "name": "GLSA-201710-06",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201710-06"
          },
          {
            "name": "RHSA-2017:2677",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2677"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "postgresql",
          "vendor": "PostgreSQL",
          "versions": [
            {
              "status": "affected",
              "version": "9.4.x before 9.4.13"
            },
            {
              "status": "affected",
              "version": "9.5.x before 9.5.8"
            },
            {
              "status": "affected",
              "version": "9.6.x before 9.6.4"
            }
          ]
        }
      ],
      "datePublic": "2017-08-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-30T10:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "DSA-3936",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3936"
        },
        {
          "name": "RHSA-2017:2678",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2678"
        },
        {
          "name": "DSA-3935",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3935"
        },
        {
          "name": "1039142",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1039142"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.postgresql.org/about/news/1772/"
        },
        {
          "name": "100276",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/100276"
        },
        {
          "name": "GLSA-201710-06",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201710-06"
        },
        {
          "name": "RHSA-2017:2677",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2677"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "DATE_PUBLIC": "2017-08-10T00:00:00",
          "ID": "CVE-2017-7548",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "postgresql",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "9.4.x before 9.4.13"
                          },
                          {
                            "version_value": "9.5.x before 9.5.8"
                          },
                          {
                            "version_value": "9.6.x before 9.6.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "PostgreSQL"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-862"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-3936",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3936"
            },
            {
              "name": "RHSA-2017:2678",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2678"
            },
            {
              "name": "DSA-3935",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3935"
            },
            {
              "name": "1039142",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1039142"
            },
            {
              "name": "https://www.postgresql.org/about/news/1772/",
              "refsource": "CONFIRM",
              "url": "https://www.postgresql.org/about/news/1772/"
            },
            {
              "name": "100276",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/100276"
            },
            {
              "name": "GLSA-201710-06",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201710-06"
            },
            {
              "name": "RHSA-2017:2677",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2677"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2017-7548",
    "datePublished": "2017-08-16T18:00:00.000Z",
    "dateReserved": "2017-04-05T00:00:00.000Z",
    "dateUpdated": "2024-09-16T16:18:38.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1052 (GCVE-0-2018-1052)

Vulnerability from cvelistv5 – Published: 2018-02-09 14:00 – Updated: 2024-09-16 17:08

Summary

Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read arbitrary bytes of server memory via purpose-crafted insert to a partitioned table.

Severity

No CVSS data available.

CWE

CWE-200

Assigner

redhat

References

2 references

URL	Tags
https://www.postgresql.org/about/news/1829/	x_refsource_CONFIRM
http://www.securityfocus.com/bid/102987	vdb-entryx_refsource_BID

Impacted products

1 product

Vendor	Product	Version
The PostgreSQL Global Development Group	postgresql	Affected: 10.x before 10.2

Date Public

2018-02-08 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:44:11.952Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.postgresql.org/about/news/1829/"
          },
          {
            "name": "102987",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/102987"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "postgresql",
          "vendor": "The PostgreSQL Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "10.x before 10.2"
            }
          ]
        }
      ],
      "datePublic": "2018-02-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read arbitrary bytes of server memory via purpose-crafted insert to a partitioned table."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-02-14T10:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.postgresql.org/about/news/1829/"
        },
        {
          "name": "102987",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/102987"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "DATE_PUBLIC": "2018-02-08T00:00:00",
          "ID": "CVE-2018-1052",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "postgresql",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "10.x before 10.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "The PostgreSQL Global Development Group"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read arbitrary bytes of server memory via purpose-crafted insert to a partitioned table."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.postgresql.org/about/news/1829/",
              "refsource": "CONFIRM",
              "url": "https://www.postgresql.org/about/news/1829/"
            },
            {
              "name": "102987",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/102987"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1052",
    "datePublished": "2018-02-09T14:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2024-09-16T17:08:06.088Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1058 (GCVE-0-2018-1058)

Vulnerability from cvelistv5 – Published: 2018-03-02 15:00 – Updated: 2024-09-17 03:22

Summary

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.

Severity

No CVSS data available.

CWE

CWE-20

Assigner

redhat

References

7 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1547044	x_refsource_CONFIRM
https://usn.ubuntu.com/3589-1/	vendor-advisoryx_refsource_UBUNTU
http://www.securityfocus.com/bid/103221	vdb-entryx_refsource_BID
https://www.postgresql.org/about/news/1834/	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:2511	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2566	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3816	vendor-advisoryx_refsource_REDHAT

Impacted products

1 product

Vendor	Product	Version
The PostgreSQL Global Development Group	postgresql	Affected: 9.3 - 10

Date Public

2018-03-01 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:44:11.804Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547044"
          },
          {
            "name": "USN-3589-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3589-1/"
          },
          {
            "name": "103221",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/103221"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.postgresql.org/about/news/1834/"
          },
          {
            "name": "RHSA-2018:2511",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2511"
          },
          {
            "name": "RHSA-2018:2566",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2566"
          },
          {
            "name": "RHSA-2018:3816",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3816"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "postgresql",
          "vendor": "The PostgreSQL Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "9.3 - 10"
            }
          ]
        }
      ],
      "datePublic": "2018-03-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-14T10:57:02.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547044"
        },
        {
          "name": "USN-3589-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3589-1/"
        },
        {
          "name": "103221",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/103221"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.postgresql.org/about/news/1834/"
        },
        {
          "name": "RHSA-2018:2511",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2511"
        },
        {
          "name": "RHSA-2018:2566",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2566"
        },
        {
          "name": "RHSA-2018:3816",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3816"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "DATE_PUBLIC": "2018-03-01T00:00:00",
          "ID": "CVE-2018-1058",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "postgresql",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "9.3 - 10"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "The PostgreSQL Global Development Group"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1547044",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547044"
            },
            {
              "name": "USN-3589-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3589-1/"
            },
            {
              "name": "103221",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/103221"
            },
            {
              "name": "https://www.postgresql.org/about/news/1834/",
              "refsource": "CONFIRM",
              "url": "https://www.postgresql.org/about/news/1834/"
            },
            {
              "name": "RHSA-2018:2511",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2511"
            },
            {
              "name": "RHSA-2018:2566",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2566"
            },
            {
              "name": "RHSA-2018:3816",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3816"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1058",
    "datePublished": "2018-03-02T15:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2024-09-17T03:22:50.533Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

Vulnerability from cleanstart

CVE-2017-15098 (GCVE-0-2017-15098)

CVE-2017-15099 (GCVE-0-2017-15099)

CVE-2017-7484 (GCVE-0-2017-7484)

CVE-2017-7485 (GCVE-0-2017-7485)

CVE-2017-7486 (GCVE-0-2017-7486)

CVE-2017-7546 (GCVE-0-2017-7546)

CVE-2017-7547 (GCVE-0-2017-7547)

CVE-2017-7548 (GCVE-0-2017-7548)

CVE-2018-1052 (GCVE-0-2018-1052)

CVE-2018-1058 (GCVE-0-2018-1058)

Tags

Sightings

Nomenclature