CVE-2017-7546 PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.
CriticalCVSS 9.8
EPSS 61.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| postgresql | = 9.2 | No fix listed |
| postgresql | = 9.2.1 | No fix listed |
| postgresql | = 9.2.2 | No fix listed |
| postgresql | = 9.2.3 | No fix listed |
| postgresql | = 9.2.4 | No fix listed |
| postgresql | = 9.2.5 | No fix listed |
| postgresql | = 9.2.6 | No fix listed |
| postgresql | = 9.2.7 | No fix listed |
| postgresql | = 9.2.8 | No fix listed |
| postgresql | = 9.2.9 | No fix listed |
| postgresql | = 9.2.10 | No fix listed |
| postgresql | = 9.2.11 | No fix listed |
| postgresql | = 9.2.12 | No fix listed |
| postgresql | = 9.2.13 | No fix listed |
| postgresql | = 9.2.14 | No fix listed |
| postgresql | = 9.2.15 | No fix listed |
| postgresql | = 9.2.16 | No fix listed |
| postgresql | = 9.2.17 | No fix listed |
| postgresql | = 9.2.18 | No fix listed |
| postgresql | = 9.2.19 | No fix listed |
| postgresql | = 9.2.20 | No fix listed |
| postgresql | = 9.2.21 | No fix listed |
| postgresql | = 9.3 | No fix listed |
| postgresql | = 9.3.1 | No fix listed |
| postgresql | = 9.3.2 | No fix listed |
Show 68 more
| Product | Affected versions | Fixed in |
|---|---|---|
| postgresql | = 9.3.3 | No fix listed |
| postgresql | = 9.3.4 | No fix listed |
| postgresql | = 9.3.5 | No fix listed |
| postgresql | = 9.3.6 | No fix listed |
| postgresql | = 9.3.7 | No fix listed |
| postgresql | = 9.3.8 | No fix listed |
| postgresql | = 9.3.9 | No fix listed |
| postgresql | = 9.3.10 | No fix listed |
| postgresql | = 9.3.11 | No fix listed |
| postgresql | = 9.3.12 | No fix listed |
| postgresql | = 9.3.13 | No fix listed |
| postgresql | = 9.3.14 | No fix listed |
| postgresql | = 9.3.15 | No fix listed |
| postgresql | = 9.3.16 | No fix listed |
| postgresql | = 9.3.17 | No fix listed |
| postgresql | = 9.4 | No fix listed |
| postgresql | = 9.4.1 | No fix listed |
| postgresql | = 9.4.2 | No fix listed |
| postgresql | = 9.4.3 | No fix listed |
| postgresql | = 9.4.4 | No fix listed |
| postgresql | = 9.4.5 | No fix listed |
| postgresql | = 9.4.6 | No fix listed |
| postgresql | = 9.4.7 | No fix listed |
| postgresql | = 9.4.8 | No fix listed |
| postgresql | = 9.4.9 | No fix listed |
| postgresql | = 9.4.10 | No fix listed |
| postgresql | = 9.4.11 | No fix listed |
| postgresql | = 9.4.12 | No fix listed |
| postgresql | = 9.5 | No fix listed |
| postgresql | = 9.5.1 | No fix listed |
| postgresql | = 9.5.2 | No fix listed |
| postgresql | = 9.5.3 | No fix listed |
| postgresql | = 9.5.4 | No fix listed |
| postgresql | = 9.5.5 | No fix listed |
| postgresql | = 9.5.6 | No fix listed |
| postgresql | = 9.5.7 | No fix listed |
| postgresql | = 9.6 | No fix listed |
| postgresql | = 9.6.1 | No fix listed |
| postgresql | = 9.6.2 | No fix listed |
| postgresql | = 9.6.3 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| alpine/postgresql(Alpine:v3.10) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql(Alpine:v3.11) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql(Alpine:v3.12) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql(Alpine:v3.13) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql(Alpine:v3.14) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql(Alpine:v3.3) | < 9.4.13-r0 | 9.4.13-r0 |
| alpine/postgresql(Alpine:v3.4) | < 9.5.8-r0 | 9.5.8-r0 |
| alpine/postgresql(Alpine:v3.5) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql(Alpine:v3.6) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql(Alpine:v3.7) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql(Alpine:v3.8) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql(Alpine:v3.9) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql14(Alpine:v3.15) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql14(Alpine:v3.16) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql14(Alpine:v3.17) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql14(Alpine:v3.18) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql14(Alpine:v3.19) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql14(Alpine:v3.20) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql15(Alpine:v3.17) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql15(Alpine:v3.18) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql15(Alpine:v3.19) | < 9.6.4-r0 | 9.6.4-r0 |
| alpine/postgresql15(Alpine:v3.20) | < 9.6.4-r0 | 9.6.4-r0 |
| postgresql | = 9.2.x before 9.2.22 | No fix listed |
| postgresql | = 9.3.x before 9.3.18 | No fix listed |
| postgresql | = 9.4.x before 9.4.13 | No fix listed |
| postgresql | = 9.5.x before 9.5.8 | No fix listed |
| postgresql | = 9.6.x before 9.6.4 | No fix listed |
References
- DSA-3935 third-party-advisory vendor-advisory
- DSA-3936 third-party-advisory vendor-advisory
- 100278 third-party-advisory vdb-entry
- 1039142 third-party-advisory vdb-entry
- RHSA-2017:2677 third-party-advisory vendor-advisory
- RHSA-2017:2678 third-party-advisory vendor-advisory
- RHSA-2017:2728 third-party-advisory vendor-advisory
- RHSA-2017:2860 third-party-advisory vendor-advisory
- GLSA-201710-06 third-party-advisory vendor-advisory
- www.postgresql.org vendor-advisory
- security.alpinelinux.org vendor-advisory