CVE-2017-15099: Infoleak
INSERT ... ON CONFLICT DO UPDATE commands disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege. Even then, not all columns are subject to disclosure.
Vulnerable Versions: 9.5 - 10
Other sources
INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this PostgreSQL vulnerability?
The vulnerability ID for this PostgreSQL vulnerability is CVE-2017-15099.
What is the severity level of CVE-2017-15099?
The severity level of CVE-2017-15099 is medium.
Which versions of PostgreSQL are affected by CVE-2017-15099?
Versions 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 of PostgreSQL are affected by CVE-2017-15099.
What is the impact of CVE-2017-15099?
CVE-2017-15099 allows an attacker to disclose table contents that they lack privilege to read.
Are there any remedies available for CVE-2017-15099?
Yes, the affected versions have remedies available, such as upgrading to version 9.5.10, 9.6.6, or 10.1 of PostgreSQL.