VYPR
Get started
← All advisories
Medium severity6.5NVD Advisory· Published Nov 22, 2017· Updated May 13, 2026

CVE-2017-15099

CVE-2017-15099

Description

INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.

Affected products

19
  • PostgreSQL/PostgreSQL17 versions
    cpe:2.3:a:postgresql:postgresql:10.0:*:*:*:*:*:*:*+ 16 more
    • cpe:2.3:a:postgresql:postgresql:10.0:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.5:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.5.5:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.5.6:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.5.7:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.5.8:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.5.9:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.6:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.6.2:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.6.3:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.6.4:*:*:*:*:*:*:*
    • cpe:2.3:a:postgresql:postgresql:9.6.5:*:*:*:*:*:*:*
  • Debian/Debian Linux
    cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • Red Hat, Inc./postgresqlv5
    Range: 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.