postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
- CVSS 3.0 Base Score: 4.2
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresqlUpgrade postgresql14 | Aug 22, 2024 | May 10, 2018 |
| Amazon_linux | — | Upgrade postgresql96 | Dec 7, 2018 | May 10, 2018 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 31, 2018 | May 10, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-devel | Aug 31, 2020 | May 10, 2018 |
| Postgres | — | Upgrade to PostgreSQL version 10.4 | Jan 7, 2019 | May 10, 2018 |
| Suse | — | Upgrade postgresql-pltclUpgrade postgresql10-plpythonUpgrade postgresql-server-develUpgrade postgresql-llvmjitUpgrade postgresql12-plperlUpgrade postgresql-contribUpgrade postgresql96-contribUpgrade postgresql96-pltclUpgrade postgresql-plpythonUpgrade postgresql96-plpythonUpgrade libecpg6Upgrade postgresql12-plpythonUpgrade postgresql12-testUpgrade postgresql10-develUpgrade postgresql12-develUpgrade postgresql10-contribUpgrade postgresql-develUpgrade postgresql96-develUpgrade postgresql10-plperlUpgrade postgresql10-pltclUpgrade postgresql12-pltclUpgrade postgresql12-server-develUpgrade postgresql10-docsUpgrade postgresql96-docsUpgrade postgresql-docsUpgrade postgresql96-plperlUpgrade postgresql12-contribUpgrade libecpg6-32bitUpgrade postgresql-serverUpgrade postgresql12-llvmjitUpgrade postgresql10-serverUpgrade postgresql12-serverUpgrade postgresql10Upgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql12-docsUpgrade postgresql12Upgrade postgresql96-serverUpgrade postgresql96Upgrade libpq5-32bitUpgrade postgresql96-testUpgrade postgresql10-testUpgrade libpq5 | Jun 16, 2018 | May 10, 2018 |
| Ubuntu | — | Upgrade postgresql-10 | Nov 19, 2024 | May 10, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub