CVE-2017-12172

EPSS 0.05%
Published 22.11.2017 19:29:00
Last modified 20.04.2025 01:37:25
Source secalert@redhat.com
Teams watchlist Login
Open Login

PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.

Affected products Warnungen 0 Metrics 3 CWE 1 References 11

Data is provided by the National Vulnerability Database (NVD)

Postgresql ≫ Postgresql Version9.2

Postgresql ≫ Postgresql Version9.2.1

Postgresql ≫ Postgresql Version9.2.2

Postgresql ≫ Postgresql Version9.2.3

Postgresql ≫ Postgresql Version9.2.4

Postgresql ≫ Postgresql Version9.2.5

Postgresql ≫ Postgresql Version9.2.6

Postgresql ≫ Postgresql Version9.2.7

Postgresql ≫ Postgresql Version9.2.8

Postgresql ≫ Postgresql Version9.2.9

Postgresql ≫ Postgresql Version9.2.10

Postgresql ≫ Postgresql Version9.2.11

Postgresql ≫ Postgresql Version9.2.12

Postgresql ≫ Postgresql Version9.2.13

Postgresql ≫ Postgresql Version9.2.14

Postgresql ≫ Postgresql Version9.2.15

Postgresql ≫ Postgresql Version9.2.16

Postgresql ≫ Postgresql Version9.2.17

Postgresql ≫ Postgresql Version9.2.18

Postgresql ≫ Postgresql Version9.2.19

Postgresql ≫ Postgresql Version9.2.20

Postgresql ≫ Postgresql Version9.2.21

Postgresql ≫ Postgresql Version9.2.22

Postgresql ≫ Postgresql Version9.2.23

Postgresql ≫ Postgresql Version9.3

Postgresql ≫ Postgresql Version9.3.1

Postgresql ≫ Postgresql Version9.3.2

Postgresql ≫ Postgresql Version9.3.3

Postgresql ≫ Postgresql Version9.3.4

Postgresql ≫ Postgresql Version9.3.5

Postgresql ≫ Postgresql Version9.3.6

Postgresql ≫ Postgresql Version9.3.7

Postgresql ≫ Postgresql Version9.3.8

Postgresql ≫ Postgresql Version9.3.9

Postgresql ≫ Postgresql Version9.3.10

Postgresql ≫ Postgresql Version9.3.11

Postgresql ≫ Postgresql Version9.3.12

Postgresql ≫ Postgresql Version9.3.13

Postgresql ≫ Postgresql Version9.3.14

Postgresql ≫ Postgresql Version9.3.15

Postgresql ≫ Postgresql Version9.3.16

Postgresql ≫ Postgresql Version9.3.17

Postgresql ≫ Postgresql Version9.3.18

Postgresql ≫ Postgresql Version9.3.19

Postgresql ≫ Postgresql Version9.4

Postgresql ≫ Postgresql Version9.4.1

Postgresql ≫ Postgresql Version9.4.2

Postgresql ≫ Postgresql Version9.4.3

Postgresql ≫ Postgresql Version9.4.4

Postgresql ≫ Postgresql Version9.4.5

Postgresql ≫ Postgresql Version9.4.6

Postgresql ≫ Postgresql Version9.4.7

Postgresql ≫ Postgresql Version9.4.8

Postgresql ≫ Postgresql Version9.4.9

Postgresql ≫ Postgresql Version9.4.10

Postgresql ≫ Postgresql Version9.4.11

Postgresql ≫ Postgresql Version9.4.12

Postgresql ≫ Postgresql Version9.4.13

Postgresql ≫ Postgresql Version9.4.14

Postgresql ≫ Postgresql Version9.5

Postgresql ≫ Postgresql Version9.5.1

Postgresql ≫ Postgresql Version9.5.2

Postgresql ≫ Postgresql Version9.5.3

Postgresql ≫ Postgresql Version9.5.4

Postgresql ≫ Postgresql Version9.5.5

Postgresql ≫ Postgresql Version9.5.6

Postgresql ≫ Postgresql Version9.5.7

Postgresql ≫ Postgresql Version9.5.8

Postgresql ≫ Postgresql Version9.5.9

Postgresql ≫ Postgresql Version9.6

Postgresql ≫ Postgresql Version9.6.1

Postgresql ≫ Postgresql Version9.6.2

Postgresql ≫ Postgresql Version9.6.3

Postgresql ≫ Postgresql Version9.6.4

Postgresql ≫ Postgresql Version9.6.5

Postgresql ≫ Postgresql Version10

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.05%	0.137

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.7	0.8	5.9	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	7.2	3.9	10	AV:L/AC:L/Au:N/C:C/I:C/A:C

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

http://www.securitytracker.com/id/1039752

Third Party Advisory

VDB Entry

https://www.postgresql.org/about/news/1801/

Vendor Advisory

Issue Tracking

https://www.postgresql.org/support/security/

Vendor Advisory

Issue Tracking

http://www.securityfocus.com/bid/101949

Third Party Advisory

VDB Entry