CVE-2017-7546

critical-risk

Published 2017-08-16

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.

Do I need to act?

33.1% chance of exploitation in next 30 days

EPSS score — higher than 67% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (20)

Postgresql

Affected Vendors

Debian Postgresql

References (20)

Third Party Advisory http://www.debian.org/security/2017/dsa-3935

Third Party Advisory http://www.debian.org/security/2017/dsa-3936

Third Party Advisory http://www.securityfocus.com/bid/100278

Third Party Advisory http://www.securitytracker.com/id/1039142

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:2677

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:2678

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:2728

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:2860

Third Party Advisory https://security.gentoo.org/glsa/201710-06

Vendor Advisory https://www.postgresql.org/about/news/1772/