Mupltiple vulnerabilities in PostgreSQL

Description

Multiple serious vulnerabilities have been found in PostgreSQL. Malicious users can exploit these vulnerabilities to bypass security restrictions and obtain sensitive information.

Below is a complete list of vulnerabilities:

1. An incorrect check of user privileges in some selectivity estimation functions can be exploited remotely possibly to bypass security restrictions or obtain sensitive information;
2. An issue with enforcing a SSL/TLS connection which is done by the PGREQUIRESSL environment variable can be exploited remotely possibly to bypass security restrictions or obtain sensitive information;
3. An improper implementation of pg_user_mappings access qualifications can be exploited remotely to obtain sensitive information.

---

Technical details

Vulnerability (1) is related to providing information from pg_static.

NB: These vulnerabilities don’t have any public CVSS ratings so rating can be changed by the time.

Original advisories

• PostgreSQL Security Update Release

Related products

• PostgreSQL

CVE list

• CVE-2017-7484
  warning
• CVE-2017-7485
  warning
• CVE-2017-7486
  warning

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com