Critical Authentication Flaw in PostgreSQL: CVE-2017-7546
Summary
ALPINE-CVE-2017-7546: PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password. Affects postgresql versions < 9.6.4-r0. Fixed in 9.6.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database system that uses and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types. However, certain versions of PostgreSQL are vulnerable to an authentication flaw that allows remote attackers to gain unauthorized access to database accounts with empty passwords. This vulnerability affects multiple versions across various Alpine Linux distributions.
Vulnerability Detail
The vulnerability, identified as CVE-2017-7546, arises from incorrect authentication mechanisms in PostgreSQL versions prior to 9.2.22, 9.3.18, 9.4.13, 9.5.8, and 9.6.4. Attackers can exploit this flaw to access database accounts without needing a password, potentially leading to unauthorized data access, data manipulation, or complete database compromise. The flaw is particularly severe, with a CVSS score of 9.8, indicating critical risk.
How To Fix
Minimum fixed version
9.6.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the database by configuring firewall rules to limit connections to trusted IP addresses or by enforcing strong password policies for all database accounts.
Conclusion
CVE-2017-7546 represents a significant security risk for PostgreSQL users, allowing unauthorized access through empty passwords. It is crucial to update to the latest patched versions to mitigate this vulnerability and protect sensitive data.
See every vulnerability recorded for postgresql →
FAQ
CVE-2017-7546 is a critical vulnerability in PostgreSQL that allows remote attackers to gain access to database accounts with empty passwords.
Versions prior to 9.2.22, 9.3.18, 9.4.13, 9.5.8, and 9.6.4 are vulnerable to this authentication flaw.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate upgrading is not possible, consider implementing firewall rules to restrict access or enforce strong password policies as a temporary workaround.
The CVSS score of CVE-2017-7546 is 9.8, indicating a critical level of risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
