CVE-2017-15098

Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.

CVSS v3 8.1 HIGH
CVSS v2.0 5.5 MEDIUM

8.1^/10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.5^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:P

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/101781	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039752	Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:2511
https://access.redhat.com/errata/RHSA-2018:2566
https://www.debian.org/security/2017/dsa-4027	Issue Tracking Third Party Advisory
https://www.debian.org/security/2017/dsa-4028	Issue Tracking Third Party Advisory
https://www.postgresql.org/about/news/1801/	Issue Tracking Vendor Advisory
https://www.postgresql.org/support/security/	Issue Tracking Vendor Advisory
http://www.securityfocus.com/bid/101781	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039752	Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:2511
https://access.redhat.com/errata/RHSA-2018:2566
https://www.debian.org/security/2017/dsa-4027	Issue Tracking Third Party Advisory
https://www.debian.org/security/2017/dsa-4028	Issue Tracking Third Party Advisory
https://www.postgresql.org/about/news/1801/	Issue Tracking Vendor Advisory
https://www.postgresql.org/support/security/	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:postgresql:postgresql:9.3:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.1:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.2:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.3:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.4:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.5:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.6:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.7:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.8:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.9:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.10:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.11:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.12:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.13:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.14:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.15:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.16:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.17:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.18:::::::*
	cpe:2.3:a:postgresql:postgresql:9.3.19:::::::*
	cpe:2.3:a:postgresql:postgresql:9.4:::::::*
	cpe:2.3:a:postgresql:postgresql:9.4.1:::::::*
	cpe:2.3:a:postgresql:postgresql:9.4.2:::::::*
	cpe:2.3:a:postgresql:postgresql:9.4.3:::::::*
	cpe:2.3:a:postgresql:postgresql:9.4.4:::::::*
	cpe:2.3:a:postgresql:postgresql:9.4.5:::::::*
	cpe:2.3:a:postgresql:postgresql:9.4.6:::::::*
	cpe:2.3:a:postgresql:postgresql:9.4.7:::::::*
	cpe:2.3:a:postgresql:postgresql:9.4.8:::::::*
	cpe:2.3:a:postgresql:postgresql:9.4.9:::::::*
	cpe:2.3:a:postgresql:postgresql:9.4.10:::::::*
	cpe:2.3:a:postgresql:postgresql:9.4.11:::::::*
	cpe:2.3:a:postgresql:postgresql:9.4.12:::::::*
	cpe:2.3:a:postgresql:postgresql:9.4.13:::::::*
	cpe:2.3:a:postgresql:postgresql:9.4.14:::::::*
	cpe:2.3:a:postgresql:postgresql:9.5:::::::*
	cpe:2.3:a:postgresql:postgresql:9.5.1:::::::*
	cpe:2.3:a:postgresql:postgresql:9.5.2:::::::*
	cpe:2.3:a:postgresql:postgresql:9.5.3:::::::*
	cpe:2.3:a:postgresql:postgresql:9.5.4:::::::*
	cpe:2.3:a:postgresql:postgresql:9.5.5:::::::*
	cpe:2.3:a:postgresql:postgresql:9.5.6:::::::*
	cpe:2.3:a:postgresql:postgresql:9.5.7:::::::*
	cpe:2.3:a:postgresql:postgresql:9.5.8:::::::*
	cpe:2.3:a:postgresql:postgresql:9.5.9:::::::*
	cpe:2.3:a:postgresql:postgresql:9.6:::::::*
	cpe:2.3:a:postgresql:postgresql:9.6.1:::::::*
	cpe:2.3:a:postgresql:postgresql:9.6.2:::::::*
	cpe:2.3:a:postgresql:postgresql:9.6.3:::::::*
	cpe:2.3:a:postgresql:postgresql:9.6.4:::::::*
	cpe:2.3:a:postgresql:postgresql:9.6.5:::::::*
	cpe:2.3:a:postgresql:postgresql:10:::::::*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-11-22 17:29

Updated : 2025-04-20 01:37

NVD link : CVE-2017-15098

Mitre link : CVE-2017-15098

CVE.ORG link : CVE-2017-15098

JSON object : View

Products Affected

postgresql

postgresql

debian

debian_linux

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

8.1 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.5 /10

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact PARTIAL

JSON object

Attach tags to CVE-2017-15098

8.1^/10

5.5^/10

Attach tags to `CVE-2017-15098`