CVE-2017-7546

CRITICAL severity · CVSS 9.8 · Improper authentication

9.8CVSS CRITICAL

Summary

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)33%

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

PostgreSQL

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
http://www.debian.org/security/2017/dsa-3935Advisory
http://www.debian.org/security/2017/dsa-3936Advisory
http://www.securityfocus.com/bid/100278Advisory
http://www.securitytracker.com/id/1039142Advisory
https://access.redhat.com/errata/RHSA-2017:2677Advisory
https://access.redhat.com/errata/RHSA-2017:2678Advisory
https://access.redhat.com/errata/RHSA-2017:2728Advisory
https://access.redhat.com/errata/RHSA-2017:2860Advisory