vulnerability

CentOS Linux: CVE-2017-12172: Moderate: postgresql security update (CESA-2017:3402)

Severity
7
CVSS
(AV:L/AC:L/Au:N/C:C/I:C/A:C)
Published
Nov 22, 2017
Added
Dec 12, 2017
Modified
May 25, 2023

Description

PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.

Solution(s)

centos-upgrade-postgresqlcentos-upgrade-postgresql-contribcentos-upgrade-postgresql-debuginfocentos-upgrade-postgresql-develcentos-upgrade-postgresql-docscentos-upgrade-postgresql-libscentos-upgrade-postgresql-plperlcentos-upgrade-postgresql-plpythoncentos-upgrade-postgresql-pltclcentos-upgrade-postgresql-servercentos-upgrade-postgresql-staticcentos-upgrade-postgresql-testcentos-upgrade-postgresql-upgrade
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.