p PatchFirst

CVE-2017-7547

CVE-2017-7547

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so.

CVSS 8.8 · High · EPSS 5.6% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • postgresql

    Versions
    • 9.2.x before 9.2.22: Affected
    • 9.3.x before 9.3.18: Affected
    • 9.4.x before 9.4.13: Affected
    • 9.5.x before 9.5.8: Affected
    • 9.6.x before 9.6.4: Affected

    No fix published

  • postgresql-9.3 Ubuntu:14.04:LTS

    Versions
    • 9.3.1-1
    • 9.3.2-1
    • 9.3.2-1ubuntu1
    • 9.3.2-1ubuntu2
    • 9.3.3-1
    • 9.3.3-1bzr1
    • 9.3.3-1bzr2
    • 9.3.4-1
    • 9.3.5-0ubuntu0.14.04.1
    • 9.3.6-0ubuntu0.14.04
    • 9.3.7-0ubuntu0.14.04
    • 9.3.8-0ubuntu0.4.04
    • 9.3.9-0ubuntu0.14.04
    • 9.3.10-0ubuntu0.14.04
    • 9.3.11-0ubuntu0.14.04
    • 9.3.12-0ubuntu0.14.04
    • 9.3.13-0ubuntu0.14.04
    • 9.3.14-0ubuntu0.14.04
    • 9.3.15-0ubuntu0.14.04
    • 9.3.16-0ubuntu0.14.04
    • 9.3.17-0ubuntu0.14.04
    Affected ranges
    • ECOSYSTEM: < 9.3.18-0ubuntu0.14.04.1

    Update to 9.3.18-0ubuntu0.14.04.1

  • postgresql-9.5 Ubuntu:16.04:LTS

    Versions
    • 9.5.0-1
    • 9.5.0-2
    • 9.5.0-3
    • 9.5.1-1
    • 9.5.2-1
    • 9.5.3-0ubuntu0.16.04
    • 9.5.4-0ubuntu0.16.04
    • 9.5.5-0ubuntu0.16.04
    • 9.5.6-0ubuntu0.16.04
    • 9.5.7-0ubuntu0.16.04
    Affected ranges
    • ECOSYSTEM: < 9.5.8-0ubuntu0.16.04.1

    Update to 9.5.8-0ubuntu0.16.04.1

Original sources

Check your server →