PT-2017-2778 · Postgresql+2 · Postgresql+2

Published 2017-05-04 · Updated 2026-01-30 · CVE-2017-7548

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 9.4.13 PostgreSQL versions prior to 9.5.8 PostgreSQL versions prior to 9.6.4

Description The issue is caused by a flaw in the authorization procedure, allowing remote authenticated attackers with no privileges on a large object to overwrite its entire contents. This results in a denial of service. The lo put() function is specifically mentioned as ignoring ACLs, contributing to the vulnerability.

Recommendations For versions prior to 9.4.13, update to version 9.4.13 or later. For versions prior to 9.5.8, update to version 9.5.8 or later. For versions prior to 9.6.4, update to version 9.6.4 or later. As a temporary workaround, consider restricting access to the lo put() function until a patch is available.

Fix

DoS

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

BDU:2017-02036

CLEANSTART-2026-FW42039

CLEANSTART-2026-HJ04971

CVE-2017-7548

DSA-3935-1

DSA-3936-1

MGASA-2017-0316

OPENSUSE-SU-2017_2306-1

OPENSUSE-SU-2017_2391-1

OPENSUSE-SU-2017_2392-1

OPENSUSE-SU-2018_0529-1

RHSA-2017:2677

RHSA-2017:2678

SUSE-SU-2017:2236-1

SUSE-SU-2017:2258-1

SUSE-SU-2017:2355-1

SUSE-SU-2017:2356-1

USN-3390-1

Affected Products

Postgresql

Suse

Ubuntu

References · 123

• https://nvd.nist.gov/vuln/detail/CVE-2023-2455 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2017-7548 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7547 · Security Note
• http://debian.org/security/2017/dsa-3935 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7548 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3677 · Security Note
• https://osv.dev/vulnerability/USN-3390-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2678 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25694 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-7485 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-23214 · Security Note
• https://postgresql.org/about/news/1772 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02036 · Security Note
• https://osv.dev/vulnerability/DSA-3935-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0316 · Vendor Advisory