postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
- CVSS 3.0 Base Score: 4.2
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresqlUpgrade postgresql15 | Aug 22, 2024 | May 10, 2018 |
| Amazon_linux | — | Upgrade postgresql96 | Dec 7, 2018 | May 10, 2018 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 31, 2018 | May 10, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-develUpgrade postgresql-server | Aug 31, 2020 | May 10, 2018 |
| Postgres | — | Upgrade to PostgreSQL version 10.4 | Jan 7, 2019 | May 10, 2018 |
| Suse | — | Upgrade postgresql-contribUpgrade postgresql96-docsUpgrade postgresql10-docsUpgrade postgresql10-develUpgrade postgresql12-server-develUpgrade postgresql12-testUpgrade postgresql-plpythonUpgrade postgresql96-pltclUpgrade postgresql96-contribUpgrade postgresql12-plperlUpgrade postgresql-develUpgrade postgresql10-plperlUpgrade postgresql12-develUpgrade libecpg6Upgrade postgresql-pltclUpgrade postgresql-server-develUpgrade postgresql-llvmjitUpgrade postgresql96-plpythonUpgrade postgresql10-contribUpgrade postgresql12-pltclUpgrade postgresql10-pltclUpgrade postgresql10-plpythonUpgrade postgresql96-develUpgrade postgresql12-plpythonUpgrade postgresql12Upgrade postgresql12-llvmjitUpgrade postgresql96-testUpgrade postgresql10-serverUpgrade postgresql10Upgrade libecpg6-32bitUpgrade postgresql12-docsUpgrade postgresql-serverUpgrade postgresql96-serverUpgrade postgresql-plperlUpgrade postgresql12-contribUpgrade postgresql-docsUpgrade postgresql10-testUpgrade postgresqlUpgrade libpq5Upgrade postgresql12-serverUpgrade postgresql96Upgrade libpq5-32bitUpgrade postgresql-testUpgrade postgresql96-plperl | Jun 16, 2018 | May 10, 2018 |
| Ubuntu | — | Upgrade postgresql-10 | Nov 19, 2024 | May 10, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub