postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
- CVSS 3.0 Base Score: 4.2
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresqlUpgrade postgresql14 | Aug 22, 2024 | May 10, 2018 |
| Amazon_linux | — | Upgrade postgresql96 | Dec 7, 2018 | May 10, 2018 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 31, 2018 | May 10, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-pltcl | Aug 31, 2020 | May 10, 2018 |
| Postgres | — | Upgrade to PostgreSQL version 10.4 | Jan 7, 2019 | May 10, 2018 |
| Suse | — | Upgrade postgresql-plperlUpgrade libecpg6-32bitUpgrade postgresqlUpgrade postgresql12Upgrade libpq5-32bitUpgrade postgresql96-testUpgrade postgresql96Upgrade postgresql96-plperlUpgrade postgresql10-serverUpgrade postgresql10-testUpgrade postgresql96-serverUpgrade postgresql10Upgrade postgresql12-contribUpgrade postgresql12-llvmjitUpgrade postgresql12-serverUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql12-docsUpgrade postgresql-docsUpgrade libpq5Upgrade postgresql10-pltclUpgrade postgresql12-testUpgrade postgresql10-plpythonUpgrade postgresql-plpythonUpgrade postgresql10-plperlUpgrade postgresql96-plpythonUpgrade postgresql-llvmjitUpgrade postgresql10-contribUpgrade postgresql12-pltclUpgrade postgresql-develUpgrade postgresql96-docsUpgrade postgresql10-docsUpgrade postgresql10-develUpgrade postgresql-contribUpgrade postgresql96-pltclUpgrade postgresql96-develUpgrade postgresql96-contribUpgrade postgresql-server-develUpgrade postgresql12-plperlUpgrade libecpg6Upgrade postgresql-pltclUpgrade postgresql12-develUpgrade postgresql12-server-develUpgrade postgresql12-plpython | Jun 16, 2018 | May 10, 2018 |
| Ubuntu | — | Upgrade postgresql-10 | Nov 19, 2024 | May 10, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub