Information disclosure in PostgreSQL - CVE-2017-7486

Vulnerability identifier: #VU6894

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7486

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper implementation of pg_user_mappings access qualifications. A remote attacker with USAGE privilege on the associated foreign server can send a specially crafted request to trigger memory leak in pg_user_mappings view and disclose foreign server passwords.

Successful exploitation of the vulnerability results in information disclosure.

PostgreSQL
Arch Linux
Gentoo Linux
Debian Linux
Amazon Linux AMI
Fedora
Red Hat Satellite
postgresql (Alpine package)
postgresql
mingw-postgresql

Install update from vendor's website.

postgresql (Alpine package) - update to 9.4.12-r0
postgresql - update to 9.6.3-1.fc26
mingw-postgresql - update to 9.6.3-1.fc26

• https://www.postgresql.org/about/news/1746/

• Arch Linux update for postgresql
• Arch Linux update for postgresql-libs
• Red Hat update for PostgreSQL
• Gentoo update for PostgreSQL
• Debian update for postgresql-9.4
• Amazon Linux AMI update for postgresql92
• Amazon Linux AMI update for postgresql93, postgresql94, postgresql95
• Red Hat update for rh-postgresql95-postgresql
• Information disclosure in postgresql (Alpine package)
• Fedora 26 update for postgresql
• Fedora 26 update for mingw-postgresql