PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql | Nov 23, 2017 | Nov 22, 2017 |
| Amazon_linux | — | Upgrade postgresql93Upgrade postgresql96Upgrade postgresql92Upgrade postgresql95Upgrade postgresql94 | Dec 7, 2017 | Nov 22, 2017 |
| Centos_linux | — | Upgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-develUpgrade postgresql-debuginfoUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-upgrade | Dec 12, 2017 | Nov 22, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-plpythonUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-libs | Jan 18, 2018 | Nov 22, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade postgresql-docsUpgrade postgresql-develUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-plpythonUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-libs | Jan 18, 2018 | Nov 22, 2017 |
| Oracle_linux | — | Upgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-develUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-test | Dec 8, 2017 | Nov 9, 2017 |
| Postgres | — | Upgrade to PostgreSQL version 10.1 | Nov 10, 2017 | Nov 10, 2017 |
| Redhat_linux | — | Upgrade postgresql-libsUpgrade postgresql-debuginfoUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-upgradeNo solution existsUpgrade postgresql-staticUpgrade postgresql-test | Dec 8, 2017 | Nov 22, 2017 |
| Suse | — | Upgrade libpq5Upgrade libpq5-32bitUpgrade postgresql94-serverUpgrade postgresql94-contribUpgrade postgresql94-develUpgrade libecpg6Upgrade postgresql94Upgrade postgresql94-docs | Jan 15, 2018 | Nov 22, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub