Over 50 bugs, along with a few serious vulnerabilities, have been reported in the last three months for PostgreSQL, the fourth most popular database management system in use today. The company’s latest security update features round of patches to deal with the bugs as well as the three security vulnerabilities that were recently identified.

Addressing Major Database Management System Flaws

The most serious vulnerability, tracked as CVE-2017-7546, has to do with PostgreSQL accepting empty passwords, SecurityWeek reported. After being patched, libpq will ignore empty password specifications and will not transmit them to the server, according to the release notes. It’s a brute-force approach to dealing with the situation, but effective nonetheless.

This flaw has a class A rating, meaning it can be exploited for privilege escalation without requiring a login. As the patch documentation explained, “An administrator might therefore believe that setting the password to empty is equivalent to disabling password login. However, with a modified or non-libpq-based client, logging in could be possible, depending on which authentication method is configured. In particular the most common method, md5, accepted empty passwords.”

Additional Password Vulnerabilities

Another password vulnerability (CVE-2017-7547) might cause passwords to be leaked to unauthorized users. A faulty attempt to fix the flaw previously known as CVE-2017-7486 still allowed a user to view the options in his or her own user mapping, even if the account lacked USAGE permission. The server might then give such a password to the user.

To fix this issue, developers restricted visibility of pg_user_mappings.umoptions to protect passwords stored as user mapping options. However, the developers noted that the patch will only work in new databases. Users looking to address the issue in older databases must take a series of steps outlined in the PostgreSQL security release.

SecurityWeek pointed out that the third vulnerability (CVE-2017-7548) could be exploited by any user to change data in a large object. This happens because of a permission check associated with the lo_put() function, which should require the same permissions as lowrite().

Patching PostgreSQL Databases

All users are strongly advised to install the latest update for PostgreSQL and update any existing database created under previous versions of the database management system. These updates are supported for versions 9.6.4, 9.5.8, 9.4.13, 9.3.18 and 9.2.22. There will be only one more update for version 9.2, which will reach its end-of-life in September 2017.