CVE-2017-7546

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
PostgreSQL	postgresql	9.2.x before 9.2.22; 9.3.x before 9.3.18; 9.4.x before 9.4.13; 9.5.x before 9.5.8; 9.6.x before 9.6.4

References

http://www.debian.org/security/2017/dsa-3935Third Party Advisory
http://www.debian.org/security/2017/dsa-3936Third Party Advisory
http://www.securityfocus.com/bid/100278Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039142Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:2677Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2678Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2728Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2860Third Party Advisory
https://security.gentoo.org/glsa/201710-06Third Party Advisory
https://www.postgresql.org/about/news/1772/Vendor Advisory
http://www.debian.org/security/2017/dsa-3935Third Party Advisory
http://www.debian.org/security/2017/dsa-3936Third Party Advisory
http://www.securityfocus.com/bid/100278Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039142Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:2677Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2678Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2728Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2860Third Party Advisory
https://security.gentoo.org/glsa/201710-06Third Party Advisory
https://www.postgresql.org/about/news/1772/Vendor Advisory

Timeline

Published: Aug 16, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-75478.8PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attack CVE-2017-75487.5PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no priv CVE-2017-75496.4A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform CVE-2017-75509.8A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Rem CVE-2017-75519.8389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different retur CVE-2017-75529.8A flaw was discovered in the file editor of millicore, affecting versions before 3.19.0 and 4.x before 4.5.0, which allows files to be execu CVE-2017-75536.3The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe CVE-2017-75546.1It was found that the App Studio component of RHMAP 4.4 executes javascript provided by a user. An attacker could use this flaw to execute a CVE-2017-75559.8Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker CVE-2017-75568.8Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their we CVE-2017-75578.8dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.CVE-2017-75587.5A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() f