PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attacker…

published 2017-08-16 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-16556

cvss: 9.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 61.6%; EPSS 61.6% chance of exploitation in 30 days, percentile 99.1%
public exploits: 0; none known

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.

Patch / fix

distros 5

ubuntu red hat suse alpine arch linux

postgresql-9.3 Ubuntu 14.04 LTS 9.3.18-0ubuntu0.14.04.1
postgresql-9.5 Ubuntu 16.04 LTS 9.5.8-0ubuntu0.16.04.1

ubuntu advisories UBUNTU-CVE-2017-7546

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

rh-postgresql94-postgresql RHEL 2 SOFTWARE_COLLECTIONS 9.4.14-1.el6
rh-postgresql94-postgresql RHEL 2 SOFTWARE_COLLECTIONS 9.4.14-1.el7
rh-postgresql94-postgresql-libs RHEL 2 SOFTWARE_COLLECTIONS 9.4.14-1.el6
rh-postgresql94-postgresql-libs RHEL 2 SOFTWARE_COLLECTIONS 9.4.14-1.el7
rh-postgresql94-postgresql-test RHEL 2 SOFTWARE_COLLECTIONS 9.4.14-1.el6
rh-postgresql94-postgresql-test RHEL 2 SOFTWARE_COLLECTIONS 9.4.14-1.el7
rh-postgresql94-postgresql-pltcl RHEL 2 SOFTWARE_COLLECTIONS 9.4.14-1.el6
rh-postgresql94-postgresql-pltcl RHEL 2 SOFTWARE_COLLECTIONS 9.4.14-1.el7

red hat advisories RHSA-2017:2678 RHSA-2017:2677 RHSA-2017:2860 RHSA-2017:2728

postgresql96 SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES for SAP 12 SP1 +9 more 9.6.4-3.6.1
postgresql96-libs SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES for SAP 12 SP1 +11 more 9.6.4-3.6.1
postgresql94 SLES for SAP 12 SP2, SLES for SAP 12 SP1, SLES for SAP 12 +6 more 9.4.13-21.5.1
postgresql94-libs SLE Software Development Kit 12 SP2 9.4.13-21.5.1
postgresql94 SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +2 more 9.4.13-0.23.5.1
postgresql94-libs SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +3 more 9.4.13-0.23.5.1
postgresql93 SLES for SAP 12, SLES 12-LTSS 9.3.18-25.5.1

suse advisories SUSE-SU-2017:2356-1 SUSE-SU-2017:2355-1 SUSE-SU-2017:2258-1 SUSE-SU-2017:2236-1

postgresql Alpine 3.14, Alpine 3.13, Alpine 3.12 +7 more 9.6.4-r0
postgresql Alpine 3.3 9.4.13-r0
postgresql Alpine 3.4 9.5.8-r0
postgresql14 Alpine 3.20, Alpine 3.19, Alpine 3.18 +3 more 9.6.4-r0
postgresql15 Alpine 3.20, Alpine 3.19, Alpine 3.18 +1 more 9.6.4-r0

alpine advisories ALPINE-CVE-2017-7546

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

postgresql Arch Linux 9.6.4-1

arch linux advisories AVG-381

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-7546 updated 2026-11-05 cvss 5.6

postgresql: Empty password accepted in some authentication methods

Red Hat Enterprise Linux 5 postgresql, postgresql84
affected: no fix planned “Will not fix”
Red Hat Satellite 5 postgresql92-postgresql
affected: no fix available
Red Hat Enterprise Linux Client (v. 7) postgresql 9.2.23-1.el7_4, postgresql-libs 9.2.23-1.el7_4 Red Hat Enterprise Linux Client Optional (v. 7) postgresql 9.2.23-1.el7_4, postgresql-test 9.2.23-1.el7_4, postgresql-pltcl 9.2.23-1.el7_4, postgresql-plperl 9.2.23-1.el7_4, postgresql-server 9.2.23-1.el7_4, postgresql-contrib 9.2.23-1.el7_4, +2 more Red Hat Enterprise Linux ComputeNode (v. 7) postgresql 9.2.23-1.el7_4, postgresql-libs 9.2.23-1.el7_4 Red Hat Enterprise Linux ComputeNode Optional (v. 7) postgresql 9.2.23-1.el7_4, postgresql-test 9.2.23-1.el7_4, postgresql-pltcl 9.2.23-1.el7_4, postgresql-plperl 9.2.23-1.el7_4, postgresql-server 9.2.23-1.el7_4, postgresql-contrib 9.2.23-1.el7_4, +2 more
fixed: vendor fix RHSA-2017:2728
Red Hat Enterprise Linux Desktop (v. 6) postgresql 8.4.20-8.el6_9, postgresql-libs 8.4.20-8.el6_9 Red Hat Enterprise Linux Desktop Optional (v. 6) postgresql 8.4.20-8.el6_9, postgresql-test 8.4.20-8.el6_9, postgresql-pltcl 8.4.20-8.el6_9, postgresql-plperl 8.4.20-8.el6_9, postgresql-server 8.4.20-8.el6_9, postgresql-contrib 8.4.20-8.el6_9, +1 more Red Hat Enterprise Linux HPC Node (v. 6) postgresql 8.4.20-8.el6_9, postgresql-libs 8.4.20-8.el6_9 Red Hat Enterprise Linux HPC Node Optional (v. 6) postgresql-test 8.4.20-8.el6_9, postgresql-pltcl 8.4.20-8.el6_9, postgresql-plperl 8.4.20-8.el6_9, postgresql-server 8.4.20-8.el6_9, postgresql-contrib 8.4.20-8.el6_9, postgresql-plpython 8.4.20-8.el6_9 Red Hat Enterprise Linux Server (v. 6) postgresql 8.4.20-8.el6_9, postgresql-libs 8.4.20-8.el6_9, postgresql-test 8.4.20-8.el6_9, postgresql-pltcl 8.4.20-8.el6_9, postgresql-plperl 8.4.20-8.el6_9, postgresql-server 8.4.20-8.el6_9, +2 more
fixed: vendor fix RHSA-2017:2860
Red Hat Enterprise Linux Server (v. 7) postgresql 9.2.23-1.el7_4, postgresql-libs 9.2.23-1.el7_4, postgresql-test 9.2.23-1.el7_4, postgresql-pltcl 9.2.23-1.el7_4, postgresql-plperl 9.2.23-1.el7_4, postgresql-server 9.2.23-1.el7_4, +2 more Red Hat Enterprise Linux Server Optional (v. 7) postgresql-upgrade 9.2.23-1.el7_4
fixed: vendor fix RHSA-2017:2728
Red Hat Enterprise Linux Workstation (v. 6) postgresql 8.4.20-8.el6_9, postgresql-libs 8.4.20-8.el6_9, postgresql-test 8.4.20-8.el6_9, postgresql-pltcl 8.4.20-8.el6_9, postgresql-plperl 8.4.20-8.el6_9, postgresql-server 8.4.20-8.el6_9, +2 more
fixed: vendor fix RHSA-2017:2860
Red Hat Enterprise Linux Workstation (v. 7) postgresql 9.2.23-1.el7_4, postgresql-libs 9.2.23-1.el7_4, postgresql-test 9.2.23-1.el7_4, postgresql-pltcl 9.2.23-1.el7_4, postgresql-plperl 9.2.23-1.el7_4, postgresql-server 9.2.23-1.el7_4, +2 more Red Hat Enterprise Linux Workstation Optional (v. 7) postgresql-upgrade 9.2.23-1.el7_4
fixed: vendor fix RHSA-2017:2728
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-postgresql95-postgresql 9.5.9-1.el6, rh-postgresql94-postgresql 9.4.14-1.el6, rh-postgresql95-postgresql-libs 9.5.9-1.el6, rh-postgresql95-postgresql-test 9.5.9-1.el6, rh-postgresql94-postgresql-libs 9.4.14-1.el6, rh-postgresql94-postgresql-test 9.4.14-1.el6, +11 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-postgresql95-postgresql 9.5.9-1.el7, rh-postgresql94-postgresql 9.4.14-1.el7, rh-postgresql95-postgresql-libs 9.5.9-1.el7, rh-postgresql95-postgresql-test 9.5.9-1.el7, rh-postgresql94-postgresql-libs 9.4.14-1.el7, rh-postgresql94-postgresql-test 9.4.14-1.el7, +11 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-postgresql95-postgresql 9.5.9-1.el6, rh-postgresql94-postgresql 9.4.14-1.el6, rh-postgresql95-postgresql-libs 9.5.9-1.el6, rh-postgresql95-postgresql-test 9.5.9-1.el6, rh-postgresql94-postgresql-libs 9.4.14-1.el6, rh-postgresql94-postgresql-test 9.4.14-1.el6, +11 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-postgresql95-postgresql 9.5.9-1.el7, rh-postgresql94-postgresql 9.4.14-1.el7, rh-postgresql95-postgresql-libs 9.5.9-1.el7, rh-postgresql95-postgresql-test 9.5.9-1.el7, rh-postgresql94-postgresql-libs 9.4.14-1.el7, rh-postgresql94-postgresql-test 9.4.14-1.el7, +11 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-postgresql95-postgresql 9.5.9-1.el6, rh-postgresql94-postgresql 9.4.14-1.el6, rh-postgresql95-postgresql-libs 9.5.9-1.el6, rh-postgresql95-postgresql-test 9.5.9-1.el6, rh-postgresql94-postgresql-libs 9.4.14-1.el6, rh-postgresql94-postgresql-test 9.4.14-1.el6, +11 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-postgresql95-postgresql 9.5.9-1.el7, rh-postgresql94-postgresql 9.4.14-1.el7, rh-postgresql95-postgresql-libs 9.5.9-1.el7, rh-postgresql95-postgresql-test 9.5.9-1.el7, rh-postgresql94-postgresql-libs 9.4.14-1.el7, rh-postgresql94-postgresql-test 9.4.14-1.el7, +11 more
fixed: vendor fix RHSA-2017:2678

show 1 more

Red Hat CloudForms Management Engine 5 rh-postgresql94-postgresql, rh-postgresql95-postgresql
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

61.57% chance of exploitation in the next 30 days, higher than 99.1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

PostgreSQL postgresql

Classification

Weakness

CWE-287 Improper Authentication

Technology feeds

PostgreSQL rss critical rss

References

access.redhat.com /errata/RHSA-2017:2728
vendor-advisory, third-party-advisory
debian.org /security/2017/dsa-3936
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2017:2678
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2017:2860
vendor-advisory, third-party-advisory
debian.org /security/2017/dsa-3935
vendor-advisory, third-party-advisory
security.gentoo.org /glsa/201710-06
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2017:2677
vendor-advisory, third-party-advisory
postgresql.org /about/news/1772/
vendor-advisory
securityfocus.com /bid/100278
vdb-entry, third-party-advisory
securitytracker.com /id/1039142
vdb-entry, third-party-advisory

Sources

CVE List CVE-2017-7546
NVD CVE-2017-7546

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary