PT-2017-3884 · Postgresql+3 · Postgresql+3

Andrew Wheelwright · Publicado 2017-05-11 · Atualizado 2026-01-30 · CVE-2017-7486

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 8.4 through 9.6

Description The issue is related to insufficient protection of registration data in the pg user mappings component of the PostgreSQL database management system. This can be exploited by a remote attacker with USAGE privileges to gain access to the credentials of a third-party server. The pg user mappings view leaks foreign server passwords to any user with USAGE privilege on the associated foreign server.

Recommendations For PostgreSQL versions 8.4 through 9.6, restrict access to the pg user mappings view to minimize the risk of exploitation. As a temporary workaround, consider revoking USAGE privileges on foreign servers from untrusted users until a patch is available.

Correção

Insufficiently Protected Credentials

Information Disclosure

Enumeração de Fraquezas

CWE-522

CWE-200

Identificadores relacionados

BDU:2019-04175

CESA-2017_1983

CLEANSTART-2026-FW42039

CLEANSTART-2026-HJ04971

CVE-2017-7486

DLA-1051-1

DSA-3851-1

MGASA-2017-0230

RHSA-2017:1677

RHSA-2017:1678

RHSA-2017:1838

RHSA-2017:1983

RHSA-2017:2425

RHSA-2017_1983

SUSE-SU-2017:1441-1

SUSE-SU-2017:1690-1

SUSE-SU-2017:1783-1

Produtos afetados

Centos

Postgresql

Red Hat

Suse

Referências · 121

• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-FW42039 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-FW42039.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-HJ04971 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-HJ04971.json · Nota
• https://postgresql.org/about/news/2017-05-11-security-update-release-1746 · Nota
• https://osv.dev/vulnerability/CVE-2017-7547 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-2455 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-7546 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7547 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-7548 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2021-3677 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2017:1677 · Aviso do Fabricante
• https://bugzilla.suse.com/1037624 · Nota
• https://osv.dev/vulnerability/CVE-2020-25694 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2020-25694 · Nota de Segurança