PostgreSQL Selectivity Estimation Function Vulnerability in Alpine Packages
Summary
ALPINE-CVE-2017-7484: It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing inf... Affects postgresql versions < 9.6.3-r0. Fixed in 9.6.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PostgreSQL is a powerful, open-source object-relational database system that uses and extends the SQL language. It is known for its reliability, robustness, and performance. The vulnerability in question affects various versions of PostgreSQL packaged in Alpine Linux distributions, specifically versions prior to 9.6.3. This vulnerability arises from inadequate privilege checks in selectivity estimation functions, potentially allowing unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability, identified as CVE-2017-7484, stems from certain selectivity estimation functions in PostgreSQL versions before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3. These functions failed to verify user privileges before revealing information from the pg_statistic table. As a result, an unprivileged attacker could exploit this flaw to extract sensitive data from tables that they should not have access to, leading to potential data leaks and privacy violations.
How To Fix
Minimum fixed version
9.6.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the PostgreSQL database and implementing strict user privilege management to minimize the risk of unauthorized access until the package can be updated.
Conclusion
In summary, CVE-2017-7484 is a significant vulnerability affecting various versions of PostgreSQL in Alpine Linux distributions. It is crucial to update to the patched version to mitigate the risk of unauthorized access to sensitive information. Users should also consider implementing temporary workarounds to enhance security until the update can be applied.
See every vulnerability recorded for postgresql →
FAQ
CVE-2017-7484 is a vulnerability in PostgreSQL that allows unauthorized users to access sensitive information due to inadequate privilege checks in selectivity estimation functions.
Affected versions include PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3.
You can use Vulert's playground at Vulert Scanner to check if your application is impacted by this vulnerability without needing to sign up.
The CVSS score for CVE-2017-7484 is 7.5, indicating a high severity level.
If immediate updates are not feasible, implement strict user privilege management and limit access to the database as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
