CVE-2017-7484 Information disclosure in PostgreSQL
Unprivileged attackers can read statistical data from inaccessible tables due to missing privilege checks in PostgreSQL selectivity estimation functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-7484?
CVE-2017-7484 is a high-severity vulnerability in Postgresql Postgresql, published on 12 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access.
Which versions are affected by CVE-2017-7484?
It affects 1 product.
Products include Postgresql Postgresql.
How do I fix CVE-2017-7484?
Upgrade to a fixed version.
Is CVE-2017-7484 being exploited?
There is no known exploitation of CVE-2017-7484 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as ALPINE-CVE-2017-7484, CLEANSTART-2026-IE79957, GHSA-pwf5-pc7m-6hp4, UBUNTU-CVE-2017-7484.