PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql | Nov 23, 2017 | Nov 22, 2017 |
| Amazon_linux | — | Upgrade postgresql94Upgrade postgresql96Upgrade postgresql92Upgrade postgresql93Upgrade postgresql95 | Dec 7, 2017 | Nov 22, 2017 |
| Centos_linux | — | Upgrade postgresql-libsUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-contrib | Dec 12, 2017 | Nov 22, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-plpython | Jan 18, 2018 | Nov 22, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade postgresql-serverUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql | Jan 18, 2018 | Nov 22, 2017 |
| Oracle_linux | — | Upgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-libsUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-devel | Dec 8, 2017 | Nov 9, 2017 |
| Postgres | — | Upgrade to PostgreSQL version 10.1 | Nov 10, 2017 | Nov 10, 2017 |
| Redhat_linux | — | Upgrade postgresql-testUpgrade postgresqlUpgrade postgresql-staticNo solution existsUpgrade postgresql-upgradeUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-debuginfoUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-plpython | Dec 8, 2017 | Nov 22, 2017 |
| Suse | — | Upgrade postgresql94-contribUpgrade postgresql94Upgrade libecpg6Upgrade postgresql94-develUpgrade postgresql94-docsUpgrade libpq5-32bitUpgrade libpq5Upgrade postgresql94-server | Jan 15, 2018 | Nov 22, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub