p PatchFirst

CVE-2017-15099

CVE-2017-15099

This page contains facts from public vulnerability sources. Check the original advisory before updating.

INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.

CVSS 6.5 · Medium · EPSS 6.3% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • postgresql

    Versions
    • 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10: Affected

    No fix published

  • postgresql-9.5 Ubuntu:16.04:LTS

    Versions
    • 9.5.0-1
    • 9.5.0-2
    • 9.5.0-3
    • 9.5.1-1
    • 9.5.2-1
    • 9.5.3-0ubuntu0.16.04
    • 9.5.4-0ubuntu0.16.04
    • 9.5.5-0ubuntu0.16.04
    • 9.5.6-0ubuntu0.16.04
    • 9.5.7-0ubuntu0.16.04
    • 9.5.8-0ubuntu0.16.04.1
    • 9.5.9-0ubuntu0.16.04
    Affected ranges
    • ECOSYSTEM: < 9.5.10-0ubuntu0.16.04

    Update to 9.5.10-0ubuntu0.16.04

Original sources

Check your server →