CVE-2017-15099: Infoleak
First published: Thu Nov 02 2017(Updated: )
INSERT ... ON CONFLICT DO UPDATE commands disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege. Even then, not all columns are subject to disclosure. Vulnerable Versions: 9.5 - 10
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/postgresql-10 | ||
| debian/postgresql-9.1 | ||
| redhat/postgresql | <9.5.10 | 9.5.10 |
| redhat/postgresql | <9.6.6 | 9.6.6 |
| redhat/postgresql | <10.1 | 10.1 |
| PostgreSQL PostgreSQL | =9.5 | |
| PostgreSQL PostgreSQL | =9.5.1 | |
| PostgreSQL PostgreSQL | =9.5.2 | |
| PostgreSQL PostgreSQL | =9.5.3 | |
| PostgreSQL PostgreSQL | =9.5.4 | |
| PostgreSQL PostgreSQL | =9.5.5 | |
| PostgreSQL PostgreSQL | =9.5.6 | |
| PostgreSQL PostgreSQL | =9.5.7 | |
| PostgreSQL PostgreSQL | =9.5.8 | |
| PostgreSQL PostgreSQL | =9.5.9 | |
| PostgreSQL PostgreSQL | =9.6 | |
| PostgreSQL PostgreSQL | =9.6.1 | |
| PostgreSQL PostgreSQL | =9.6.2 | |
| PostgreSQL PostgreSQL | =9.6.3 | |
| PostgreSQL PostgreSQL | =9.6.4 | |
| PostgreSQL PostgreSQL | =9.6.5 | |
| PostgreSQL PostgreSQL | =10.0 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/101781
- http://www.securitytracker.com/id/1039752
- https://access.redhat.com/errata/RHSA-2018:2511
- https://access.redhat.com/errata/RHSA-2018:2566
- https://www.debian.org/security/2017/dsa-4028
- https://www.postgresql.org/about/news/1801/
- https://www.postgresql.org/support/security/
- https://access.redhat.com/security/updates/classification/
- https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=87b2ebd
- https://bugzilla.redhat.com/show_bug.cgi?id=1508823
- https://security-tracker.debian.org/tracker/CVE-2017-15099
Frequently Asked Questions
What is the vulnerability ID for this PostgreSQL vulnerability?
The vulnerability ID for this PostgreSQL vulnerability is CVE-2017-15099.
What is the severity level of CVE-2017-15099?
The severity level of CVE-2017-15099 is medium.
Which versions of PostgreSQL are affected by CVE-2017-15099?
Versions 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 of PostgreSQL are affected by CVE-2017-15099.
What is the impact of CVE-2017-15099?
CVE-2017-15099 allows an attacker to disclose table contents that they lack privilege to read.
Are there any remedies available for CVE-2017-15099?
Yes, the affected versions have remedies available, such as upgrading to version 9.5.10, 9.6.6, or 10.1 of PostgreSQL.
- collector/security-tracker-debian
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/severity
- agent/author
- agent/references
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-15099
- agent/software-canonical-lookup
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- package-manager/debian
- package-manager/redhat
- vendor/postgresql
- canonical/postgresql postgresql
- version/postgresql postgresql/9.5
- version/postgresql postgresql/9.5.1
- version/postgresql postgresql/9.5.2
- version/postgresql postgresql/9.5.3
- version/postgresql postgresql/9.5.4
- version/postgresql postgresql/9.5.5
- version/postgresql postgresql/9.5.6
- version/postgresql postgresql/9.5.7
- version/postgresql postgresql/9.5.8
- version/postgresql postgresql/9.5.9
- version/postgresql postgresql/9.6
- version/postgresql postgresql/9.6.1
- version/postgresql postgresql/9.6.2
- version/postgresql postgresql/9.6.3
- version/postgresql postgresql/9.6.4
- version/postgresql postgresql/9.6.5
- version/postgresql postgresql/10.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0