Information disclosure in PostgreSQL - CVE-2017-7484

Vulnerability identifier: #VU6892

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7484

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper privilege checking before providing information from pg_statistic. A remote attacker can send a specially crafted request to bypass SELECT privilege checks, cause memory leak and steal some information from ostensibly restricted tables.

Successful exploitation of the vulnerability results in information disclosure.

PostgreSQL
Arch Linux
Gentoo Linux
Debian Linux
Amazon Linux AMI
openEuler
Anolis OS
Fedora
IBM Observability with Instana
Red Hat Satellite
postgresql (Alpine package)
mingw-postgresql
postgresql
postgresql-llvmjit
postgresql-docs
postgresql-debugsource
postgresql-debuginfo
postgresql-contrib
postgresql-test-rpm-macros
postgresql-test
postgresql-static
postgresql-server-devel
postgresql-server
postgresql-private-libs
postgresql-private-devel
postgresql-pltcl
postgresql-plpython3
postgresql-plperl
libpq-devel
libpq-debugsource
libpq-debuginfo
libpq
postgresql-upgrade-devel
postgresql-upgrade

Update to versions 9.2.21, 9.3.17, 9.4.12, 9.5.7, 9.6.3.

IBM Observability with Instana - update to 1.0.309
postgresql (Alpine package) - update to 9.4.12-r0
mingw-postgresql - update to 9.6.3-1.fc26
postgresql - update to 9.6.3-1.fc26
postgresql-llvmjit - addressed in versions 13.22-1, 15.14-1
postgresql-docs - addressed in versions 13.22-1, 15.14-1
postgresql-debugsource - addressed in versions 13.22-1, 15.14-1
postgresql-debuginfo - addressed in versions 13.22-1, 15.14-1
postgresql-contrib - addressed in versions 13.22-1, 15.14-1
postgresql - addressed in versions 13.22-1, 15.14-1
postgresql-test-rpm-macros - addressed in versions 13.22-1, 15.14-1
postgresql-test - addressed in versions 13.22-1, 15.14-1
postgresql-static - addressed in versions 13.22-1, 15.14-1
postgresql-server-devel - addressed in versions 13.22-1, 15.14-1
postgresql-server - addressed in versions 13.22-1, 15.14-1
postgresql-private-libs - addressed in versions 13.22-1, 15.14-1
postgresql-private-devel - addressed in versions 13.22-1, 15.14-1
postgresql-pltcl - addressed in versions 13.22-1, 15.14-1
postgresql-plpython3 - addressed in versions 13.22-1, 15.14-1
postgresql-plperl - addressed in versions 13.22-1, 15.14-1
libpq-devel - addressed in versions 13.22-1, 15.14-1
libpq-debugsource - addressed in versions 13.22-1, 15.14-1
libpq-debuginfo - addressed in versions 13.22-1, 15.14-1
libpq - addressed in versions 13.22-1, 15.14-1
postgresql-private-devel - update to 15.14-1
postgresql-test-rpm-macros - update to 15.14-1
postgresql-upgrade-devel - update to 15.14-1
postgresql-upgrade - update to 15.14-1
postgresql-test - update to 15.14-1
postgresql-static - update to 15.14-1
postgresql-server-devel - update to 15.14-1
postgresql-server - update to 15.14-1
postgresql-private-libs - update to 15.14-1
postgresql-pltcl - update to 15.14-1
postgresql-plpython3 - update to 15.14-1
postgresql-plperl - update to 15.14-1
postgresql-docs - update to 15.14-1
postgresql-contrib - update to 15.14-1
postgresql - update to 15.14-1

• https://www.postgresql.org/about/news/1746/

• Arch Linux update for postgresql
• Arch Linux update for postgresql-libs
• Red Hat update for PostgreSQL
• Gentoo update for PostgreSQL
• Debian update for postgresql-9.4
• Amazon Linux AMI update for postgresql92
• Amazon Linux AMI update for postgresql93, postgresql94, postgresql95
• Red Hat update for rh-postgresql95-postgresql
• Information disclosure in postgresql (Alpine package)
• Fedora 26 update for postgresql
• Fedora 26 update for mingw-postgresql
• openEuler 24.03 LTS SP2 update for postgresql
• openEuler 24.03 LTS SP1 update for postgresql
• openEuler 22.03 LTS SP4 update for postgresql
• openEuler 22.03 LTS SP3 update for postgresql
• openEuler 24.03 LTS SP2 update for libpq
• openEuler 24.03 LTS SP1 update for libpq
• openEuler 22.03 LTS SP4 update for libpq
• openEuler 22.03 LTS SP3 update for libpq
• openEuler 24.03 LTS update for libpq
• openEuler 24.03 LTS update for postgresql
• Anolis OS update for postgresql
• Multiple vulnerabilities in IBM Observability with Instana