vulnwire
6.7med

CVE-2017-12172

PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 run…

Published 8 y ago · modified 24 d ago · JSON

CVSS
6.7
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 48%
Public exploits
0
none known

PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
total
Assessed
24 d ago

Exploit prediction (EPSS)

0.59% probability of exploitation in the next 30 days, higher than 48% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.7CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Red Hat, Inc. postgresql

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access
Technology feeds
PostgreSQL (RSS, critical only)

References

  • access.redhat.com /errata/RHSA-2017:3402 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securityfocus.com /bid/101949 · vdb-entry, x_refsource_BID, x_transferred
  • access.redhat.com /errata/RHSA-2017:3403 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2017:3405 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • postgresql.org /support/security/ · x_refsource_MISC, x_transferred
  • securitytracker.com /id/1039752 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • postgresql.org /about/news/1801/ · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2017:3404 · vendor-advisory, x_refsource_REDHAT, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.