PT-2017-3860 · Postgresql+2 · Postgresql+2
Published
2017-09-11
·
Updated
2026-01-30
·
CVE-2017-15099
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
PostgreSQL versions 10.x prior to 10.1
PostgreSQL versions 9.6.x prior to 9.6.6
PostgreSQL versions 9.5.x prior to 9.5.10
Description
The issue is related to the implementation of the
INSERT ... ON CONFLICT DO UPDATE command in PostgreSQL, which lacks protection for internal data. This can allow a remote attacker to gain unauthorized access to protected information. The commands can disclose table contents to an invoker who lacks the privilege to read them, affecting tables where the attacker has INSERT and UPDATE privileges but not full read access. The exploits bypass row-level security policies and the lack of SELECT privilege.Recommendations
For PostgreSQL versions 10.x prior to 10.1, update to version 10.1 or later.
For PostgreSQL versions 9.6.x prior to 9.6.6, update to version 9.6.6 or later.
For PostgreSQL versions 9.5.x prior to 9.5.10, update to version 9.5.10 or later.
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Postgresql
Suse
Ubuntu