{"id":"CVE-2017-15098","aliases":["ALPINE-CVE-2017-15098","BELL-CVE-2017-15098","DEBIAN-CVE-2017-15098","DSA-4027-1","DSA-4028-1","EUVD-2017-6565","GHSA-4r9v-fq66-c5gx","MGASA-2017-0428","RHSA-2018:2511","RHSA-2018:2566","SUSE-SU-2017:3391-1","SUSE-SU-2018:0077-1","SUSE-SU-2018:0081-1","UBUNTU-CVE-2017-15098","USN-3479-1","openSUSE-SU-2024:11184-1"],"status":"published","title":"Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x...","description":"Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03723,"percentile":0.89872,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2017-11-09T00:00:00Z","modified":"2026-08-05T10:05:37Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"postgresql","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"postgresql","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"postgresql","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"postgresql","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"postgresql","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"postgresql","fixed_in":["9.4.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"postgresql","fixed_in":["9.5.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"postgresql","fixed_in":["9.6.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"postgresql","fixed_in":["9.6.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"postgresql","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"postgresql","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"postgresql","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"postgresql14","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"postgresql14","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"postgresql14","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"postgresql14","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"postgresql15","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"postgresql15","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"postgresql15","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"postgresql15","fixed_in":["10.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"postgresql-9.4","fixed_in":["9.4.15-0+deb8u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"postgresql-9.3","fixed_in":["9.3.20-0ubuntu0.14.04"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"postgresql-9.5","fixed_in":["9.5.10-0ubuntu0.16.04"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"postgresql14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"postgresql14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"postgresql14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"postgresql14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"postgresql-9.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15-0+deb8u1"}]}],"versions":["9.4.1-1","9.4.10-0+deb8u1","9.4.11-0+deb8u1","9.4.11-0+deb8u1~bpo7+1","9.4.11-0+deb8u2","9.4.12-0+deb8u1","9.4.12-0+deb8u1~bpo7+1","9.4.13-0+deb8u1","9.4.14-0+deb8u1","9.4.2-0+deb8u1","9.4.2-1","9.4.3-0+deb8u1","9.4.3-1","9.4.4-0+deb8u1","9.4.4-1","9.4.4-2","9.4.5-0+deb8u1","9.4.5-0+deb8u1~bpo70+1","9.4.5-1","9.4.5-2","9.4.6-0+deb8u1","9.4.6-0+deb8u1~bpo70+1","9.4.7-0+deb8u1","9.4.7-0+deb8u1~bpo70+1","9.4.7-0+deb8u1~bpo70+2","9.4.8-0+deb8u1","9.4.9-0+deb8u1"]},{"source":"osv","ecosystem":"Debian:9","package":"postgresql-9.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-0+deb9u1"}]}],"versions":["9.6.3-3","9.6.3-4","9.6.4-0+deb9u1","9.6.4-1","9.6.5-0+deb9u1","9.6.5-0+deb9u1~bpo8+1","9.6.5-1","9.6.6-0+deb9u1~bpo8+1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"postgresql9.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.20-1.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:5","package":"postgresql9.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15-1.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"postgresql9.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15-1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"postgresql9.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-contrib-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-server-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-contrib-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-server-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.6-3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15-0.23.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15-0.23.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15-0.23.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15-0.23.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15-0.23.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15-21.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15-21.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15-21.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15-21.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15-21.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"postgresql-9.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.20-0ubuntu0.14.04"}]}],"versions":["9.3.1-1","9.3.2-1","9.3.2-1ubuntu1","9.3.2-1ubuntu2","9.3.3-1","9.3.3-1bzr1","9.3.3-1bzr2","9.3.4-1","9.3.5-0ubuntu0.14.04.1","9.3.6-0ubuntu0.14.04","9.3.7-0ubuntu0.14.04","9.3.8-0ubuntu0.4.04","9.3.9-0ubuntu0.14.04","9.3.10-0ubuntu0.14.04","9.3.11-0ubuntu0.14.04","9.3.12-0ubuntu0.14.04","9.3.13-0ubuntu0.14.04","9.3.14-0ubuntu0.14.04","9.3.15-0ubuntu0.14.04","9.3.16-0ubuntu0.14.04","9.3.17-0ubuntu0.14.04","9.3.18-0ubuntu0.14.04.1","9.3.19-0ubuntu0.14.04"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"postgresql-9.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.10-0ubuntu0.16.04"}]}],"versions":["9.5.0-1","9.5.0-2","9.5.0-3","9.5.1-1","9.5.2-1","9.5.3-0ubuntu0.16.04","9.5.4-0ubuntu0.16.04","9.5.5-0ubuntu0.16.04","9.5.6-0ubuntu0.16.04","9.5.7-0ubuntu0.16.04","9.5.8-0ubuntu0.16.04.1","9.5.9-0ubuntu0.16.04"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"postgresql-9.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.20-0ubuntu0.14.04"}]}],"versions":["9.3.1-1","9.3.2-1","9.3.2-1ubuntu1","9.3.2-1ubuntu2","9.3.3-1","9.3.3-1bzr1","9.3.3-1bzr2","9.3.4-1","9.3.5-0ubuntu0.14.04.1","9.3.6-0ubuntu0.14.04","9.3.7-0ubuntu0.14.04","9.3.8-0ubuntu0.4.04","9.3.9-0ubuntu0.14.04","9.3.10-0ubuntu0.14.04","9.3.11-0ubuntu0.14.04","9.3.12-0ubuntu0.14.04","9.3.13-0ubuntu0.14.04","9.3.14-0ubuntu0.14.04","9.3.15-0ubuntu0.14.04","9.3.16-0ubuntu0.14.04","9.3.17-0ubuntu0.14.04","9.3.18-0ubuntu0.14.04.1","9.3.19-0ubuntu0.14.04"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"postgresql-9.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.10-0ubuntu0.16.04"}]}],"versions":["9.5.0-1","9.5.0-2","9.5.0-3","9.5.1-1","9.5.2-1","9.5.3-0ubuntu0.16.04","9.5.4-0ubuntu0.16.04","9.5.5-0ubuntu0.16.04","9.5.6-0ubuntu0.16.04","9.5.7-0ubuntu0.16.04","9.5.8-0ubuntu0.16.04.1","9.5.9-0ubuntu0.16.04"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"postgresql10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.18-1.3"}]}],"bundled":20}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"postgresql","product":"postgresql"},{"vendor":"red hat, inc.","product":"postgresql"}],"references":[{"url":"http://www.securityfocus.com/bid/101781","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.debian.org/security/2017/dsa-4027","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2511","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://www.postgresql.org/support/security/","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"http://www.securitytracker.com/id/1039752","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.postgresql.org/about/news/1801/","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report","web","article"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2566","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://www.debian.org/security/2017/dsa-4028","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15098","tags":["advisory"]},{"url":"https://www.postgresql.org/about/news/1801"},{"url":"https://www.postgresql.org/support/security"},{"url":"https://github.com/advisories/GHSA-4r9v-fq66-c5gx"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-15098","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-15098","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0428.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22002","tags":["report"]},{"url":"https://www.postgresql.org/docs/9.3/static/release-9-3-20.html","tags":["web"]},{"url":"https://www.postgresql.org/docs/9.4/static/release-9-4-15.html","tags":["web"]},{"url":"https://www.postgresql.org/docs/9.6/static/release-9-6-6.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1508820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1508823","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1539619","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1547044","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1609891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1612619","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2511.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15098","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15098","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15099","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15099","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15099","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1053","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1053","tags":["advisory"]},{"url":"https://www.postgresql.org/about/news/1829/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1058","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1058","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1058","tags":["advisory"]},{"url":"https://www.postgresql.org/about/news/1834/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-10915","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10915","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10915","tags":["advisory"]},{"url":"https://www.postgresql.org/about/news/1878/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-10925","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10925","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1573276","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2566.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1115","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1115","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1115","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173391-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1067841","tags":["report"]},{"url":"https://bugzilla.suse.com/1067844","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15099","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180077-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1062538","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12172","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180081-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-15098","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3479-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-15099","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32028","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-15098","description":"Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.","status":"published","published":"2017-11-22T17:00:00Z","modified":"2024-09-16T23:10:51.25Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:33:14.271248Z"}],"euvd":[{"id":"EUVD-2017-6565","description":"Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.","status":"published","published":"2017-11-22T17:00:00Z","modified":"2024-09-16T23:10:51Z","updated_at":"2026-11-03T00:54:56.209754Z"}],"ghsa":[{"id":"GHSA-4r9v-fq66-c5gx","title":"Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x...","description":"Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.","status":"published","published":"2022-05-14T03:04:23Z","modified":"2025-04-20T03:49:56Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:01:56.152144Z"}],"nvd":[{"id":"CVE-2017-15098","description":"Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.","status":"published","published":"2017-11-22T17:29:00.467Z","modified":"2026-06-17T01:07:14.827Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:09.7374Z"}],"osv":[{"id":"ALPINE-CVE-2017-15098","description":"Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.","status":"published","published":"2017-11-22T17:29:00.467Z","modified":"2026-06-15T18:24:24.693216629Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2017-15098","title":"CVE-2017-15098 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:50.336389Z","modified":"2026-01-26T09:47:13.684135Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-15098","description":"Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.","status":"published","published":"2017-11-22T17:29:00.467Z","modified":"2026-04-16T06:20:49.757770026Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"RHSA-2018:2511","title":"Red Hat Security Advisory: rh-postgresql95-postgresql security update","status":"published","published":"2024-09-13T16:52:18Z","modified":"2026-08-05T10:05:33Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2018:2566","title":"Red Hat Security Advisory: rh-postgresql96-postgresql security update","status":"published","published":"2024-09-13T16:52:24Z","modified":"2026-08-05T10:05:37Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2017-15098","description":"Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.","status":"published","published":"2017-11-09T00:00:00Z","modified":"2026-04-22T11:17:52.270334Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"DSA-4027-1","title":"postgresql-9.4 - security update","status":"published","published":"2017-11-09T00:00:00Z","modified":"2026-03-09T01:22:41.546311Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"DSA-4028-1","title":"postgresql-9.6 - security update","status":"published","published":"2017-11-09T00:00:00Z","modified":"2026-03-09T01:22:45.471733Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0428","title":"Updated postgresql packages fix security vulnerabilities","description":"The startup log file for the postmaster (in newer releases, \"postgres\")\nprocess was opened while the process was still owned by root. With this\nsetup, the database owner could specify a file that they did not have\naccess to and cause the file to be corrupted with logged data\n(CVE-2017-12172).\n\nCrash due to rowtype mismatch in json{b}_populate_recordset(). These\nfunctions used the result rowtype specified in the FROM ... AS clause\nwithout checking that it matched the actual rowtype of the supplied\ntuple value. If it didn't, that would usually result in a crash, though\ndisclosure of server memory contents seems possible as well\n(CVE-2017-15098).\n\nThe \"INSERT ... ON CONFLICT DO UPDATE\" would not check to see if the\nexecuting user had permission to perform a \"SELECT\" on the index\nperforming the conflicting check. Additionally, in a table with\nrow-level security enabled, the \"INSERT ... ON CONFLICT DO UPDATE\" would\nnot check the SELECT policies for that table before performing the\nupdate (CVE-2017-15099).\n","status":"published","published":"2017-11-29T18:52:42Z","modified":"2026-04-16T06:24:42.132592654Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11184-1","title":"postgresql10-10.18-1.3 on GA media","description":"These are all security issues fixed in the postgresql10-10.18-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:15:59.478865Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2017:3391-1","title":"Security update for postgresql96","description":"This update for postgresql96 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-15098: Fix crash due to rowtype mismatch in json{b}_populate_recordset() (bsc#1067844).\n- CVE-2017-15099: Ensure that INSERT ... ON CONFLICT DO UPDATE checks table permissions and RLS policies in all cases (bsc#1067841).\n\nBug fixes:\n\n- Update to version 9.6.6:\n  * https://www.postgresql.org/docs/9.6/static/release-9-6-6.html\n  * https://www.postgresql.org/docs/9.6/static/release-9-6-5.html\n","status":"published","published":"2017-12-21T07:31:18Z","modified":"2026-02-04T03:07:36.793614Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0077-1","title":"Security update for postgresql94","description":"This update for postgresql94 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-15098: Fix crash due to rowtype mismatch in json{b}_populate_recordset() (bsc#1067844).\n- CVE-2017-12172: Start scripts permit database administrator to modify root-owned files. This issue did not affect SUSE (bsc#1062538).\n\nBug fixes:\n\n- Update to version 9.4.15\n  * https://www.postgresql.org/docs/9.4/static/release-9-4-15.html\n  * https://www.postgresql.org/docs/9.4/static/release-9-4-14.html\n","status":"published","published":"2018-01-12T12:16:39Z","modified":"2026-02-04T03:32:03.193208Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0081-1","title":"Security update for postgresql94","description":"This update for postgresql94 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-15098: Fix crash due to rowtype mismatch in json{b}_populate_recordset() (bsc#1067844).\n- CVE-2017-12172: Start scripts permit database administrator to modify root-owned files. This issue did not affect SUSE (bsc#1062538).\n\nBug fixes:\n\n- Update to version 9.4.15\n  * https://www.postgresql.org/docs/9.4/static/release-9-4-15.html\n  * https://www.postgresql.org/docs/9.4/static/release-9-4-14.html\n","status":"published","published":"2018-01-12T14:46:25Z","modified":"2026-02-04T03:16:31.671613Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-3479-1","title":"postgresql-9.3, postgresql-9.5, postgresql-9.6 vulnerabilities","description":"David Rowley discovered that PostgreSQL incorrectly handled memory when\nprocessing certain JSON functions. A remote attacker could possibly use\nthis issue to obtain sensitive information. (CVE-2017-15098)\n\nDean Rasheed discovered that PostgreSQL incorrectly enforced SELECT\nprivileges when processing INSERT ... ON CONFLICT DO UPDATE commands. A\nremote attacker could possibly use this issue to obtain sensitive\ninformation. This issue only affected Ubuntu 16.04 LTS, Ubuntu 17.04 and\nUbuntu 17.10.\n","status":"published","published":"2017-11-14T12:29:44Z","modified":"2026-04-22T09:41:05.741951Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}