Lucene search

[email protected]CVE-2017-15098

HistoryNov 22, 2017 - 5:29 p.m.

CVE-2017-15098

2017-11-2217:29:00

CWE-200

[email protected]

web.nvd.nist.gov

286

cve-2017-15098

json_populate_recordset

jsonb_populate_recordset

postgresql

server crash

memory disclosure

nvd

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:N/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

7.5 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.2%

JSON

Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.

Affected configurations

Vulners

NVD

Node

red_hat\,_inc.postgresqlRange10.0–10.1

red_hat\,_inc.postgresqlRange9.6.0–9.6.6

red_hat\,_inc.postgresqlRange9.5.0–9.5.10

red_hat\,_inc.postgresqlRange9.4.0–9.4.15

red_hat\,_inc.postgresqlRange9.3.0–9.3.20

CPENameOperatorVersion
postgresql:postgresqlpostgresqleq9.3
postgresql:postgresqlpostgresqleq9.3.1
postgresql:postgresqlpostgresqleq9.3.2
postgresql:postgresqlpostgresqleq9.3.3
postgresql:postgresqlpostgresqleq9.3.4
postgresql:postgresqlpostgresqleq9.3.5
postgresql:postgresqlpostgresqleq9.3.6
postgresql:postgresqlpostgresqleq9.3.7
postgresql:postgresqlpostgresqleq9.3.8
postgresql:postgresqlpostgresqleq9.3.9

CPE	Name	Operator	Version
postgresql:postgresql	postgresql	eq	9.3
postgresql:postgresql	postgresql	eq	9.3.1
postgresql:postgresql	postgresql	eq	9.3.2
postgresql:postgresql	postgresql	eq	9.3.3
postgresql:postgresql	postgresql	eq	9.3.4
postgresql:postgresql	postgresql	eq	9.3.5
postgresql:postgresql	postgresql	eq	9.3.6
postgresql:postgresql	postgresql	eq	9.3.7
postgresql:postgresql	postgresql	eq	9.3.8
postgresql:postgresql	postgresql	eq	9.3.9

Rows per page:

1-10 of 521

CNA Affected

[
  {
    "product": "postgresql",
    "vendor": "Red Hat, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20"
      }
    ]
  }
]