8th February 2024: PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 Released!

CVE-2017-15099

INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges

Version Information

Affected Version Fixed In Fix Published
10 10.1 2017-11-09
9.6 9.6.6 2017-11-09
9.5 9.5.10 2017-11-09

For more information about PostgreSQL versioning, please visit the versioning page.

CVSS 3.0

Overall Score 3.1
Component core server
Vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Reporting Security Vulnerabilities

If you wish to report a new security vulnerability in PostgreSQL, please send an email to security@postgresql.org.

For reporting non-security bugs, please see the Report a Bug page.