critique
CVE-2017-7546
postgresql: Empty password accepted in some authentication methods
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.6CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (moyenne), Amazon (moyenne), Oracle (moyenne), Ubuntu (faible).
Description
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.10 | postgresql | 9.6.4-r0 |
| alpine 3.11 | postgresql | 9.6.4-r0 |
| alpine 3.12 | postgresql | 9.6.4-r0 |
| alpine 3.13 | postgresql | 9.6.4-r0 |
| alpine 3.14 | postgresql | 9.6.4-r0 |
| alpine 3.15 | postgresql14 | 9.6.4-r0 |
| alpine 3.16 | postgresql14 | 9.6.4-r0 |
| alpine 3.17 | postgresql14, postgresql15 | 9.6.4-r0 |
| alpine 3.18 | postgresql14, postgresql15 | 9.6.4-r0 |
| alpine 3.19 | postgresql14, postgresql15 | 9.6.4-r0 |
| alpine 3.20 | postgresql14, postgresql15 | 9.6.4-r0 |
| alpine 3.3 | postgresql | 9.4.13-r0 |
Afficher les 112 entrées de 29 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.10 | postgresql | 9.6.4-r0 |
| alpine 3.11 | postgresql | 9.6.4-r0 |
| alpine 3.12 | postgresql | 9.6.4-r0 |
| alpine 3.13 | postgresql | 9.6.4-r0 |
| alpine 3.14 | postgresql | 9.6.4-r0 |
| alpine 3.15 | postgresql14 | 9.6.4-r0 |
| alpine 3.16 | postgresql14 | 9.6.4-r0 |
| alpine 3.17 | postgresql14 | 9.6.4-r0 |
| alpine 3.17 | postgresql15 | 9.6.4-r0 |
| alpine 3.18 | postgresql14 | 9.6.4-r0 |
| alpine 3.18 | postgresql15 | 9.6.4-r0 |
| alpine 3.19 | postgresql14 | 9.6.4-r0 |
| alpine 3.19 | postgresql15 | 9.6.4-r0 |
| alpine 3.20 | postgresql14 | 9.6.4-r0 |
| alpine 3.20 | postgresql15 | 9.6.4-r0 |
| alpine 3.3 | postgresql | 9.4.13-r0 |
| alpine 3.4 | postgresql | 9.5.8-r0 |
| alpine 3.5 | postgresql | 9.6.4-r0 |
| alpine 3.6 | postgresql | 9.6.4-r0 |
| alpine 3.7 | postgresql | 9.6.4-r0 |
| alpine 3.8 | postgresql | 9.6.4-r0 |
| alpine 3.9 | postgresql | 9.6.4-r0 |
| amazon linux 1 | postgresql92 | 9.2.22-1.61.amzn1 |
| amazon linux 1 | postgresql92-contrib | 9.2.22-1.61.amzn1 |
| amazon linux 1 | postgresql92-debuginfo | 9.2.22-1.61.amzn1 |
| amazon linux 1 | postgresql92-devel | 9.2.22-1.61.amzn1 |
| amazon linux 1 | postgresql92-docs | 9.2.22-1.61.amzn1 |
| amazon linux 1 | postgresql92-libs | 9.2.22-1.61.amzn1 |
| amazon linux 1 | postgresql92-plperl | 9.2.22-1.61.amzn1 |
| amazon linux 1 | postgresql92-plpython26 | 9.2.22-1.61.amzn1 |
| amazon linux 1 | postgresql92-plpython27 | 9.2.22-1.61.amzn1 |
| amazon linux 1 | postgresql92-pltcl | 9.2.22-1.61.amzn1 |
| amazon linux 1 | postgresql92-server | 9.2.22-1.61.amzn1 |
| amazon linux 1 | postgresql92-server-compat | 9.2.22-1.61.amzn1 |
| amazon linux 1 | postgresql92-test | 9.2.22-1.61.amzn1 |
| amazon linux 1 | postgresql93 | 9.3.18-1.64.amzn1 |
| amazon linux 1 | postgresql93-contrib | 9.3.18-1.64.amzn1 |
| amazon linux 1 | postgresql93-debuginfo | 9.3.18-1.64.amzn1 |
| amazon linux 1 | postgresql93-devel | 9.3.18-1.64.amzn1 |
| amazon linux 1 | postgresql93-docs | 9.3.18-1.64.amzn1 |
| amazon linux 1 | postgresql93-libs | 9.3.18-1.64.amzn1 |
| amazon linux 1 | postgresql93-plperl | 9.3.18-1.64.amzn1 |
| amazon linux 1 | postgresql93-plpython26 | 9.3.18-1.64.amzn1 |
| amazon linux 1 | postgresql93-plpython27 | 9.3.18-1.64.amzn1 |
| amazon linux 1 | postgresql93-pltcl | 9.3.18-1.64.amzn1 |
| amazon linux 1 | postgresql93-server | 9.3.18-1.64.amzn1 |
| amazon linux 1 | postgresql93-test | 9.3.18-1.64.amzn1 |
| amazon linux 1 | postgresql94 | 9.4.13-1.69.amzn1 |
| amazon linux 1 | postgresql94-contrib | 9.4.13-1.69.amzn1 |
| amazon linux 1 | postgresql94-debuginfo | 9.4.13-1.69.amzn1 |
| amazon linux 1 | postgresql94-devel | 9.4.13-1.69.amzn1 |
| amazon linux 1 | postgresql94-docs | 9.4.13-1.69.amzn1 |
| amazon linux 1 | postgresql94-libs | 9.4.13-1.69.amzn1 |
| amazon linux 1 | postgresql94-plperl | 9.4.13-1.69.amzn1 |
| amazon linux 1 | postgresql94-plpython26 | 9.4.13-1.69.amzn1 |
| amazon linux 1 | postgresql94-plpython27 | 9.4.13-1.69.amzn1 |
| amazon linux 1 | postgresql94-server | 9.4.13-1.69.amzn1 |
| amazon linux 1 | postgresql94-test | 9.4.13-1.69.amzn1 |
| amazon linux 1 | postgresql95 | 9.5.8-1.73.amzn1 |
| amazon linux 1 | postgresql95-contrib | 9.5.8-1.73.amzn1 |
| amazon linux 1 | postgresql95-debuginfo | 9.5.8-1.73.amzn1 |
| amazon linux 1 | postgresql95-devel | 9.5.8-1.73.amzn1 |
| amazon linux 1 | postgresql95-docs | 9.5.8-1.73.amzn1 |
| amazon linux 1 | postgresql95-libs | 9.5.8-1.73.amzn1 |
| amazon linux 1 | postgresql95-plperl | 9.5.8-1.73.amzn1 |
| amazon linux 1 | postgresql95-plpython26 | 9.5.8-1.73.amzn1 |
| amazon linux 1 | postgresql95-plpython27 | 9.5.8-1.73.amzn1 |
| amazon linux 1 | postgresql95-server | 9.5.8-1.73.amzn1 |
| amazon linux 1 | postgresql95-static | 9.5.8-1.73.amzn1 |
| amazon linux 1 | postgresql95-test | 9.5.8-1.73.amzn1 |
| amazon linux 1 | postgresql96 | 9.6.4-1.77.amzn1 |
| amazon linux 1 | postgresql96-contrib | 9.6.4-1.77.amzn1 |
| amazon linux 1 | postgresql96-debuginfo | 9.6.4-1.77.amzn1 |
| amazon linux 1 | postgresql96-devel | 9.6.4-1.77.amzn1 |
| amazon linux 1 | postgresql96-docs | 9.6.4-1.77.amzn1 |
| amazon linux 1 | postgresql96-libs | 9.6.4-1.77.amzn1 |
| amazon linux 1 | postgresql96-plperl | 9.6.4-1.77.amzn1 |
| amazon linux 1 | postgresql96-plpython26 | 9.6.4-1.77.amzn1 |
| amazon linux 1 | postgresql96-plpython27 | 9.6.4-1.77.amzn1 |
| amazon linux 1 | postgresql96-server | 9.6.4-1.77.amzn1 |
| amazon linux 1 | postgresql96-static | 9.6.4-1.77.amzn1 |
| amazon linux 1 | postgresql96-test | 9.6.4-1.77.amzn1 |
| debian 7 | postgresql-9.1 | 9.1.24lts2-0+deb7u1 |
| debian 8 | postgresql-9.4 | 9.4.13-0+deb8u1 |
| debian 9 | postgresql-9.6 | 9.6.4-0+deb9u1 |
| Oracle Linux 6 | postgresql | 8.4.20-8.el6_9 |
| Oracle Linux 6 | postgresql-contrib | 8.4.20-8.el6_9 |
| Oracle Linux 6 | postgresql-devel | 8.4.20-8.el6_9 |
| Oracle Linux 6 | postgresql-docs | 8.4.20-8.el6_9 |
| Oracle Linux 6 | postgresql-libs | 8.4.20-8.el6_9 |
| Oracle Linux 6 | postgresql-plperl | 8.4.20-8.el6_9 |
| Oracle Linux 6 | postgresql-plpython | 8.4.20-8.el6_9 |
| Oracle Linux 6 | postgresql-pltcl | 8.4.20-8.el6_9 |
| Oracle Linux 6 | postgresql-server | 8.4.20-8.el6_9 |
| Oracle Linux 6 | postgresql-test | 8.4.20-8.el6_9 |
| Oracle Linux 7 | postgresql | 9.2.23-1.el7_4 |
| Oracle Linux 7 | postgresql-contrib | 9.2.23-1.el7_4 |
| Oracle Linux 7 | postgresql-devel | 9.2.23-1.el7_4 |
| Oracle Linux 7 | postgresql-docs | 9.2.23-1.el7_4 |
| Oracle Linux 7 | postgresql-libs | 9.2.23-1.el7_4 |
| Oracle Linux 7 | postgresql-plperl | 9.2.23-1.el7_4 |
| Oracle Linux 7 | postgresql-plpython | 9.2.23-1.el7_4 |
| Oracle Linux 7 | postgresql-pltcl | 9.2.23-1.el7_4 |
| Oracle Linux 7 | postgresql-server | 9.2.23-1.el7_4 |
| Oracle Linux 7 | postgresql-static | 9.2.23-1.el7_4 |
| Oracle Linux 7 | postgresql-test | 9.2.23-1.el7_4 |
| Oracle Linux 7 | postgresql-upgrade | 9.2.23-1.el7_4 |
| ubuntu 14.04 | postgresql-9.3 | 9.3.18-0ubuntu0.14.04.1 |
| ubuntu 14.04-ESM | postgresql-9.3 | 9.3.18-0ubuntu0.14.04.1 |
| ubuntu 16.04 | postgresql-9.5 | 9.5.8-0ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | postgresql-9.5 | 9.5.8-0ubuntu0.16.04.1 |
| ubuntu 17.04 | postgresql-9.6 | 9.6.4-0ubuntu0.17.04.1 |
Références
- http://www.debian.org/security/2017/dsa-3935
- http://www.debian.org/security/2017/dsa-3936
- http://www.securityfocus.com/bid/100278
- http://www.securitytracker.com/id/1039142
- https://access.redhat.com/errata/RHSA-2017:2677
- https://access.redhat.com/errata/RHSA-2017:2678
- https://access.redhat.com/errata/RHSA-2017:2728
- https://access.redhat.com/errata/RHSA-2017:2860
Les 16 références
- https://access.redhat.com/security/cve/CVE-2017-7546
- https://linux.oracle.com/cve/CVE-2017-7546.html
- https://linux.oracle.com/errata/ELSA-2017-2860.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-7546
- https://security.gentoo.org/glsa/201710-06
- https://ubuntu.com/security/notices/USN-3390-1
- https://www.cve.org/CVERecord?id=CVE-2017-7546
- https://www.postgresql.org/about/news/1772/