PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x...
High severity
Unreviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Apr 20, 2025
Package
No package
60D1
listed—
Suggest a package
Affected versions
Unknown
Patched versions
Unknown
Description
Published by the National Vulnerability Database
Nov 22, 2017
Published to the GitHub Advisory Database
May 13, 2022
Last updated
Apr 20, 2025
PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.
References