CVE-2017-7547

State: PUBLISHED · Published: 2017-08-16 · Updated: 2024-09-16 · Assigner: redhat

Description

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so.

CWE

CWE-522 — CWE-522

Affected

PostgreSQL / postgresql — v=9.2.x before 9.2.22 [affected]; v=9.3.x before 9.3.18 [affected]; v=9.4.x before 9.4.13 [affected]; v=9.5.x before 9.5.8 [affected]; v=9.6.x before 9.6.4 [affected]

CVSS

(none)

References

https://access.redhat.com/errata/RHSA-2017:2728 vendor-advisory, x_refsource_REDHAT
http://www.debian.org/security/2017/dsa-3936 vendor-advisory, x_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2017:2678 vendor-advisory, x_refsource_REDHAT
http://www.debian.org/security/2017/dsa-3935 vendor-advisory, x_refsource_DEBIAN
http://www.securitytracker.com/id/1039142 vdb-entry, x_refsource_SECTRACK
https://www.postgresql.org/about/news/1772/ x_refsource_CONFIRM
https://security.gentoo.org/glsa/201710-06 vendor-advisory, x_refsource_GENTOO
http://www.securityfocus.com/bid/100275 vdb-entry, x_refsource_BID
https://access.redhat.com/errata/RHSA-2017:2677 vendor-advisory, x_refsource_REDHAT

Source

cvelistV5-main/cves/2017/7xxx/CVE-2017-7547.json