CVE-2017-7548: High severity postgresql vulnerability
PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.
Other sources
Users with no privilege on a large object can overwrite the entire content of the object.
Supported vulnerable versions: 9.4 - 9.6
Upstream patch:
https://github.com/postgres/postgres/commit/f1cda6d6cbb2
Bug introduced in:
https://github.com/postgres/postgres/commit/c50b7c09d852b6d
The first affected upstream version is 9.4.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7548?
CVE-2017-7548 is considered to have a moderate severity due to the potential for denial of service from unauthorized overwriting of large objects.
How do I fix CVE-2017-7548?
To fix CVE-2017-7548, upgrade PostgreSQL to versions 9.4.13, 9.5.8, or 9.6.4 or later.
Who is affected by CVE-2017-7548?
CVE-2017-7548 affects PostgreSQL versions prior to 9.4.13, 9.5.8, and 9.6.4.
What type of vulnerability is CVE-2017-7548?
CVE-2017-7548 is an authorization flaw that allows remote authenticated attackers to overwrite large objects.
Can CVE-2017-7548 be exploited remotely?
Yes, CVE-2017-7548 can be exploited remotely by authenticated users who lack privileges on large objects.