CVE-2017-15098

What it actually does

Invalid calls to json_populate_recordset or jsonb_populate_recordset functions allow a PostgreSQL server to crash or leak a few bytes of server memory.

Why it matters to the business

Service interruptions or limited memory disclosure affecting 98 downstream dependents; urgency remains low given no KEV listing or ransomware use despite 3242 days since publication.

How an attack unfolds

An authenticated attacker supplies crafted JSON to the vulnerable functions, triggering a crash or small memory read; no named threat actors or public exploits are associated.

How to fix it

Upgrade tensorflow (Bitnami) to version 2.1.4 or later; apply equivalent PostgreSQL updates for any underlying 9.3–10.0 installations.

How to confirm the fix worked

Confirm package version is at least 2.1.4; test function calls with known-malformed JSON to verify no crash or memory leak occurs.

Typical attack path

1. Obtain valid database credentials with access to call the functions
2. Submit malformed JSON input to json_populate_recordset or jsonb_populate_recordset
3. Observe server crash or capture leaked memory bytes

How to detect it

Review PostgreSQL logs for repeated crashes or errors referencing json_populate_recordset/jsonb_populate_recordset; no widespread exploitation artifacts reported.

What your security team should do

• Prioritize upgrade of tensorflow (Bitnami) to 2.1.4 within standard change windows
• Audit database roles for unnecessary access to the affected functions
• Monitor EPSS trend (stable at 0.0372) and re-evaluate if exploit maturity changes