CVE-2017-7546

What it actually does

Incorrect authentication logic permits remote connections to succeed against database accounts configured with empty passwords, bypassing intended credential checks.

Why it matters to the business

Attackers can directly access and modify database contents, exposing sensitive information, disrupting operations, and risking compliance violations in environments still running unpatched PostgreSQL.

How an attack unfolds

An attacker establishes a network connection to an exposed PostgreSQL instance and supplies an empty password string for any account that lacks a password hash; the flawed authentication path accepts the connection without enforcing proper verification, granting full database privileges.

How to fix it

Upgrade PostgreSQL to at least 9.2.22, 9.3.18, 9.4.13, 9.5.8 or 9.6.4. After upgrade, enforce password policies on all accounts and restrict network access to trusted sources only.

How to confirm the fix worked

Verify running version meets or exceeds the listed fixed releases, attempt connection with empty passwords from a test client to confirm rejection, and review pg_hba.conf for appropriate authentication methods.

Typical attack path

1. Scan for publicly reachable PostgreSQL ports
2. Identify accounts without password hashes
3. Connect using empty password credentials
4. Execute arbitrary SQL or extract data

How to detect it

Review PostgreSQL server logs for successful authentication records that show empty or null password fields, unexpected remote client addresses, or connections to accounts known to have no password set.

• authentication success with empty password
• FATAL: no PostgreSQL user name specified in startup packet
• connection authorized: user=.* password=\(null\)

What your security team should do

• Immediately patch all PostgreSQL instances to the fixed versions
• Audit existing user accounts and set strong passwords where empty
• Limit PostgreSQL exposure to private networks or VPNs
• Enable detailed logging of authentication events for ongoing monitoring