CVE-2017-15098

Description

Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.

Risk Information

Base Score

8.1

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

EPSS Score

Exploitation Probability

0.772

Associated Vulnerability

Vulnerability	OS Platform
Update PostgressSQL to 9.3.20	Windows
Update PostgressSQL to 9.5.10	Windows
Vulnerabilities CVE-2017-15099,CVE-2017-15098,CVE-2017-12172 are fixed in PostgreSQL 10.1	Windows
Vulnerabilities CVE-2017-15099,CVE-2017-15098,CVE-2017-12172 are fixed in PostgreSQL 9.6.6	Windows
Vulnerabilities CVE-2017-15099,CVE-2017-15098,CVE-2017-12172 are fixed in PostgreSQL 9.5.10	Windows
Vulnerabilities CVE-2017-15098,CVE-2017-12172 are fixed in PostgreSQL 9.4.15	Windows
Vulnerabilities CVE-2017-15098,CVE-2017-12172 are fixed in PostgreSQL 9.3.20	Windows
Object-relational SQL database (USN-3479-1) postgresql-9.6_9.6.6-0ubuntu0.17.04_i386.deb	Linux
Object-relational SQL database (USN-3479-1) postgresql-9.6_9.6.6-0ubuntu0.17.04_amd64.deb	Linux
Update PostgressSQL to 9.3.20 (For Linux)	Linux
Update PostgressSQL to 9.5.10 (For Linux)	Linux
Vulnerabilities CVE-2017-15099,CVE-2017-15098,CVE-2017-12172 are fixed in PostgreSQL 10.1 (For Linux)	Linux
Vulnerabilities CVE-2017-15099,CVE-2017-15098,CVE-2017-12172 are fixed in PostgreSQL 9.6.6 (For Linux)	Linux
Vulnerabilities CVE-2017-15099,CVE-2017-15098,CVE-2017-12172 are fixed in PostgreSQL 9.5.10 (For Linux)	Linux
Vulnerabilities CVE-2017-15098,CVE-2017-12172 are fixed in PostgreSQL 9.4.15 (For Linux)	Linux
Vulnerabilities CVE-2017-15098,CVE-2017-12172 are fixed in PostgreSQL 9.3.20 (For Linux)	Linux
Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-15098)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234