Description (CNA)
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| PostgreSQL / postgresql | affected 9.2.x before 9.2.22; affected 9.3.x before 9.3.18; affected 9.4.x before 9.4.13; affected 9.5.x before 9.5.8; affected 9.6.x before 9.6.4 |
CWE
CWE-287
References
- https://access.redhat.com/errata/RHSA-2017:2728
- http://www.debian.org/security/2017/dsa-3936
- https://access.redhat.com/errata/RHSA-2017:2678
- https://access.redhat.com/errata/RHSA-2017:2860
- http://www.securityfocus.com/bid/100278
- http://www.debian.org/security/2017/dsa-3935
- http://www.securitytracker.com/id/1039142
- https://www.postgresql.org/about/news/1772/
- https://security.gentoo.org/glsa/201710-06
- https://access.redhat.com/errata/RHSA-2017:2677
ADP enrichment
No English description supplied.
- https://access.redhat.com/errata/RHSA-2017:2728
- http://www.debian.org/security/2017/dsa-3936
- https://access.redhat.com/errata/RHSA-2017:2678
- https://access.redhat.com/errata/RHSA-2017:2860
- http://www.securityfocus.com/bid/100278
- http://www.debian.org/security/2017/dsa-3935
- http://www.securitytracker.com/id/1039142
- https://www.postgresql.org/about/news/1772/
- https://security.gentoo.org/glsa/201710-06
- https://access.redhat.com/errata/RHSA-2017:2677