Description
PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a (1) ALTER USER or (2) ALTER DATABASE statement.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | postgresql-8.3 | 8.3.11-0lenny1 | DSA-2051-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | postgresql18 | 18.3-1.2.hum1 | RHSA-2026:8756 |
Advisories 2
- RHSA-2026:8756 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- DSA-2051-1 postgresql-8.3 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.postgresql.org/docs/current/static/release-8-1-21.html
- HPSBMU02781 vendor-advisory
- DSA-2051 vendor-advisory
- http://www.postgresql.org/docs/current/static/release-7-4-29.html
- http://www.postgresql.org/docs/current/static/release-8-0-25.html
- oval:org.mitre.oval:def:11004 vdb-entry signature
- ADV-2010-1221 vdb-entry
- http://www.postgresql.org/docs/current/static/release-8-3-11.html
- ADV-2010-1207 vdb-entry
- http://www.postgresql.org/docs/current/static/release-8-2-17.html
- http://www.postgresql.org/docs/current/static/release-8-4-4.html
- SUSE-SR:2010:014 vendor-advisory
- 40304 vdb-entry
- MDVSA-2010:103 vendor-advisory
- 39939 third-party-advisory