Описание
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.
It was found that the pg_user_mappings view could disclose information about user mappings to a foreign database to non-administrative database users. A database user with USAGE privilege for this mapping could, when querying the view, obtain user mapping data, such as the username and password used to connect to the foreign database.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| CloudForms Management Engine 5 | rh-postgresql94-postgresql | Affected | ||
| CloudForms Management Engine 5 | rh-postgresql95-postgresql | Affected | ||
| Red Hat Enterprise Linux 5 | postgresql | Not affected | ||
| Red Hat Enterprise Linux 5 | postgresql84 | Will not fix | ||
| Red Hat Enterprise Linux 6 | postgresql | Will not fix | ||
| Red Hat Enterprise Linux 7 | postgresql | Fixed | RHSA-2017:1983 | 01.08.2017 |
| Red Hat Satellite 5.7 | rh-postgresql95 | Fixed | RHSA-2017:2425 | 07.08.2017 |
| Red Hat Satellite 5.7 | rh-postgresql95-postgresql | Fixed | RHSA-2017:2425 | 07.08.2017 |
| Red Hat Satellite 5.7 | spacewalk-backend | Fixed | RHSA-2017:2425 | 07.08.2017 |
| Red Hat Satellite 5.7 | spacewalk-postgresql-server | Fixed | RHSA-2017:2425 | 07.08.2017 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.3 Medium
CVSS3
Связанные уязвимости
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg ...
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.
Уязвимость компонента pg_user_mappings системы управления базами данных PostgreSQL, позволяющая нарушителю получить доступ к учетным данным стороннего сервера
EPSS
6.3 Medium
CVSS3