Critical Authorization Flaw in PostgreSQL - CVE-2017-7548
Summary
ALPINE-CVE-2017-7548: PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulti... Affects postgresql versions < 9.6.4-r0. Fixed in 9.6.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database system that uses and extends the SQL language. It is known for its reliability, feature robustness, and performance. However, certain versions of PostgreSQL are vulnerable to an authorization flaw that allows remote authenticated attackers to overwrite large objects, leading to potential denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2017-7548, affects PostgreSQL versions prior to 9.4.13, 9.5.8, and 9.6.4. It arises from improper authorization checks that permit authenticated users without privileges on a large object to overwrite its entire contents. This flaw can lead to significant service disruptions and data integrity issues, as attackers can manipulate critical database objects.
How To Fix
Minimum fixed version
9.6.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the PostgreSQL database to trusted users only. Implementing strict user permissions can help mitigate the risk until the package is updated.
Conclusion
CVE-2017-7548 is a critical vulnerability affecting multiple versions of PostgreSQL, allowing unauthorized access to large objects. It is crucial for users to update their PostgreSQL installations to the latest patched versions to mitigate this risk. Implementing strict user permissions can serve as a temporary workaround.
See every vulnerability recorded for postgresql →
FAQ
CVE-2017-7548 is a vulnerability in PostgreSQL that allows remote authenticated attackers to overwrite large objects due to improper authorization checks.
PostgreSQL versions before 9.4.13, 9.5.8, and 9.6.4 are vulnerable to this issue.
The vulnerability can lead to denial of service, data corruption, and unauthorized data manipulation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2017-7548 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
