CVE-2017-15099

NameCVE-2017-15099
DescriptionINSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4028-1
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
postgresql-9.1 (PTS)jessie9.1.22-0+deb8u1fixed
jessie (security)9.1.16-0+deb8u1fixed
postgresql-9.4 (PTS)jessie9.4.18-0+deb8u1fixed
jessie (security)9.4.19-0+deb8u1fixed
postgresql-9.6 (PTS)stretch (security), stretch9.6.10-0+deb9u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
postgresql-10source(unstable)10.1-1medium
postgresql-9.1source(unstable)(not affected)
postgresql-9.4source(unstable)(not affected)
postgresql-9.6source(unstable)(unfixed)medium
postgresql-9.6sourcestretch9.6.6-0+deb9u1mediumDSA-4028-1

Notes

- postgresql-9.4 <not-affected> (ON CONFLICT DO UPDATE and RLS introduced in 9.5)
- postgresql-9.1 <not-affected> (ON CONFLICT DO UPDATE and RLS introduced in 9.5)

Search for package or bug name: Reporting problems