postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
- CVSS 3.0 Base Score: 4.2
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql15Upgrade postgresql14 | Aug 22, 2024 | May 10, 2018 |
| Amazon_linux | — | Upgrade postgresql96 | Dec 7, 2018 | May 10, 2018 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 31, 2018 | May 10, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresqlUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-develUpgrade postgresql-libs | Aug 31, 2020 | May 10, 2018 |
| Postgres | — | Upgrade to PostgreSQL version 10.4 | Jan 7, 2019 | May 10, 2018 |
| Suse | — | Upgrade postgresql12-develUpgrade postgresql10-docsUpgrade postgresql-plpythonUpgrade postgresql10-develUpgrade postgresql96-develUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql96-pltclUpgrade postgresql-contribUpgrade postgresql-server-develUpgrade postgresql-llvmjitUpgrade libecpg6Upgrade postgresql10-contribUpgrade postgresql96-contribUpgrade postgresql12-plperlUpgrade postgresql96-docsUpgrade postgresql12-plpythonUpgrade postgresql12-server-develUpgrade postgresql12-pltclUpgrade postgresql10-plperlUpgrade postgresql10-plpythonUpgrade postgresql96-plpythonUpgrade postgresql10-pltclUpgrade postgresql12-testUpgrade postgresql12Upgrade libpq5Upgrade postgresql96-plperlUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql10-testUpgrade postgresql-docsUpgrade postgresql12-llvmjitUpgrade postgresql10Upgrade libecpg6-32bitUpgrade postgresql12-docsUpgrade postgresql-serverUpgrade postgresql96-serverUpgrade postgresql12-serverUpgrade postgresql-testUpgrade postgresql12-contribUpgrade postgresql10-serverUpgrade libpq5-32bitUpgrade postgresql96Upgrade postgresql96-test | Jun 16, 2018 | May 10, 2018 |
| Ubuntu | — | Upgrade postgresql-10 | Nov 19, 2024 | May 10, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub