CVE-2017-15098: Infoleak
Invalid jsonpopulaterecordset or jsonbpopulaterecordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.
Other sources
Invalid jsonpopulaterecordset() or jsonbpopulaterecordset() calls crash the server or disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely.
Vulnerable Versions: 9.3 - 10
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15098?
CVE-2017-15098 is classified as a medium severity vulnerability that can cause server crashes or reveal sensitive memory contents in PostgreSQL.
How do I fix CVE-2017-15098?
To resolve CVE-2017-15098, upgrade PostgreSQL to version 10.1, 9.6.6, 9.5.10, 9.4.15, or 9.3.20 or later.
What outcomes can occur if CVE-2017-15098 is exploited?
Exploitation of CVE-2017-15098 may lead to a server crash or potential exposure of sensitive information from memory.
Which PostgreSQL versions are affected by CVE-2017-15098?
CVE-2017-15098 affects PostgreSQL versions 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20.
Is there a workaround for CVE-2017-15098?
While upgrading is the recommended solution for CVE-2017-15098, users can mitigate risks by avoiding the use of invalid json_populate_recordset or jsonb_populate_recordset function calls.