Orta CVSS 6.7
CVE-2017-12172: Postgresql: güvenlik açığı
Açıklama (NVD)
PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.
Özet bilgiler
- Ürün
- Postgresql Postgresql
- CVSS v3.1
- 6.7
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS
- %0,59 (yüzdelik 48)
- CWE
- CWE-59
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| postgresql-postgresql | 9.2 | 9.2 | — |
| postgresql-postgresql | 9.2.1 | 9.2.1 | — |
| postgresql-postgresql | 9.2.2 | 9.2.2 | — |
| postgresql-postgresql | 9.2.3 | 9.2.3 | — |
| postgresql-postgresql | 9.2.4 | 9.2.4 | — |
| postgresql-postgresql | 9.2.5 | 9.2.5 | — |
| postgresql-postgresql | 9.2.6 | 9.2.6 | — |
| postgresql-postgresql | 9.2.7 | 9.2.7 | — |
| postgresql-postgresql | 9.2.8 | 9.2.8 | — |
| postgresql-postgresql | 9.2.9 | 9.2.9 | — |
| postgresql-postgresql | 9.2.10 | 9.2.10 | — |
| postgresql-postgresql | 9.2.11 | 9.2.11 | — |
| postgresql-postgresql | 9.2.12 | 9.2.12 | — |
| postgresql-postgresql | 9.2.13 | 9.2.13 | — |
| postgresql-postgresql | 9.2.14 | 9.2.14 | — |
| postgresql-postgresql | 9.2.15 | 9.2.15 | — |
| postgresql-postgresql | 9.2.16 | 9.2.16 | — |
| postgresql-postgresql | 9.2.17 | 9.2.17 | — |
| postgresql-postgresql | 9.2.18 | 9.2.18 | — |
| postgresql-postgresql | 9.2.19 | 9.2.19 | — |
| postgresql-postgresql | 9.2.20 | 9.2.20 | — |
| postgresql-postgresql | 9.2.21 | 9.2.21 | — |
| postgresql-postgresql | 9.2.22 | 9.2.22 | — |
| postgresql-postgresql | 9.2.23 | 9.2.23 | — |
| postgresql-postgresql | 9.3 | 9.3 | — |
| postgresql-postgresql | 9.3.1 | 9.3.1 | — |
| postgresql-postgresql | 9.3.2 | 9.3.2 | — |
| postgresql-postgresql | 9.3.3 | 9.3.3 | — |
| postgresql-postgresql | 9.3.4 | 9.3.4 | — |
| postgresql-postgresql | 9.3.5 | 9.3.5 | — |
Kaynaklar
- NVD kaydı
- www.securityfocus.com
- www.securitytracker.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- www.postgresql.org
- www.postgresql.org
- www.securityfocus.com
- www.securitytracker.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- www.postgresql.org
- www.postgresql.org
- CWE-59