CVE-2017-7546: Critical severity postgresql vulnerability
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.
Other sources
Several authentication methods, including the widely-used "md5" method, permit empty passwords. On the client side, libpq will not send an empty password. This may have given a false impression that an empty password was equivalent to disabling the account with respect to authentication methods requiring a password. On the contrary, an attacker could easily authenticate as the user.
Supported vulnerable versions: 9.2 - 9.6
Upstream patch:
https://github.com/postgres/postgres/commit/d5d46d99ba47f
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7546?
CVE-2017-7546 has a medium severity rating due to its potential impact on database security by allowing authentication with empty passwords.
How do I fix CVE-2017-7546?
To fix CVE-2017-7546, upgrade PostgreSQL to version 9.2.22, 9.3.18, 9.4.13, 9.5.8, or 9.6.4 or newer.
Which versions of PostgreSQL are affected by CVE-2017-7546?
CVE-2017-7546 affects PostgreSQL versions prior to 9.2.22, 9.3.18, 9.4.13, 9.5.8, and 9.6.4.
What types of attacks are enabled by CVE-2017-7546?
CVE-2017-7546 allows remote attackers to authenticate to database accounts using empty passwords, compromising database security.
Is there immediate action required for CVE-2017-7546?
Yes, immediate action is required to upgrade vulnerable PostgreSQL versions to mitigate security risks associated with CVE-2017-7546.