postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.
CVSS Details
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
- CVSS 3.0 Base Score: 4.2
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql15Upgrade postgresql14 | Aug 22, 2024 | May 10, 2018 |
| Amazon_linux | — | Upgrade postgresql96 | Dec 7, 2018 | May 10, 2018 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 31, 2018 | May 10, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-libs | Aug 31, 2020 | May 10, 2018 |
| Postgres | — | Upgrade to PostgreSQL version 10.4 | Jan 7, 2019 | May 10, 2018 |
| Suse | — | Upgrade postgresql10Upgrade postgresql-docsUpgrade libecpg6-32bitUpgrade libpq5-32bitUpgrade postgresql12-docsUpgrade postgresql96-testUpgrade postgresql12Upgrade postgresql96-serverUpgrade postgresql96Upgrade postgresql10-testUpgrade postgresql10-serverUpgrade postgresql12-contribUpgrade postgresql96-plperlUpgrade postgresql-serverUpgrade postgresql-testUpgrade libpq5Upgrade postgresql12-llvmjitUpgrade postgresql-plperlUpgrade postgresql12-serverUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql10-plperlUpgrade postgresql96-contribUpgrade postgresql96-develUpgrade postgresql-pltclUpgrade postgresql12-develUpgrade postgresql-llvmjitUpgrade postgresql12-plpythonUpgrade postgresql10-plpythonUpgrade postgresql96-plpythonUpgrade postgresql12-plperlUpgrade libecpg6Upgrade postgresql12-pltclUpgrade postgresql12-server-develUpgrade postgresql10-pltclUpgrade postgresql12-testUpgrade postgresql10-docsUpgrade postgresql96-docsUpgrade postgresql10-develUpgrade postgresql-server-develUpgrade postgresql-develUpgrade postgresql-plpythonUpgrade postgresql10-contribUpgrade postgresql96-pltcl | Jun 16, 2018 | May 10, 2018 |
| Ubuntu | — | Upgrade postgresql-10 | Nov 19, 2024 | May 10, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub