SB20170613101 - Information disclosure in postgresql (Alpine package) 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20170613101

SB20170613101 - Information disclosure in postgresql (Alpine package)

Published: June 13, 2017

Security Bulletin ID SB20170613101
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Information disclosure (CVE-ID: CVE-2017-7486)

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper implementation of pg_user_mappings access qualifications. A remote attacker with USAGE privilege on the associated foreign server can send a specially crafted request to trigger memory leak in pg_user_mappings view and disclose foreign server passwords.

Successful exploitation of the vulnerability results in information disclosure.

Remediation

Install update from vendor's website.

References