Postgres has issued three security patches for 9.6.4, 9.5.8,. 9.4.13, and 9.2.22 versions. The issue derives from the databases handling of pg_user_mappings, it allows a remote and authenticated attacker to retrieve passwords from user mappings that foreign server owners defined for the user in question. The last flaw fixed is the CVE-2017-7548 in the lo_put() function, which had a missing permission check that allowed any user to change data in a large object”]
Source: https://securityaffairs.co/wordpress/61990/breaking-news/postgresql-isecurity-patches.html