Privilege Escalation in postgresql-common
Summary
CVE-2019-3466: The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation. Affects postgresql-common versions < 0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
postgresql-common is a package that provides a common infrastructure for managing multiple PostgreSQL clusters. It includes scripts and utilities for starting, stopping, and managing PostgreSQL instances. This vulnerability affects versions prior to 210 of postgresql-common. The package is commonly used in Alpine Linux distributions.
Vulnerability Detail
The vulnerability, identified as CVE-2019-3466, arises from the pg_ctlcluster script in postgresql-common. This script fails to drop privileges when creating socket/statistics temporary directories. As a result, a local attacker with limited privileges can exploit this flaw to escalate their privileges and gain unauthorized access to sensitive information or perform malicious actions on the system.
How To Fix
To fix this vulnerability, it is recommended to update postgresql-common to version 210 or later. This can be done by applying the relevant security patches provided by the package maintainers or by upgrading to a newer version of the package.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the privilege escalation vulnerability in postgresql-common (CVE-2019-3466) can be mitigated by updating the package to version 210 or later. It is important to promptly apply the necessary security patches or upgrade to a newer version to ensure the security and integrity of the system. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql-common →
FAQ
This vulnerability allows a local attacker to escalate their privileges and potentially gain unauthorized access to sensitive information or perform malicious actions on the system.
Versions prior to 210 of postgresql-common are affected by this vulnerability.
There is no known exploit available for this vulnerability at the moment.
The recommended mitigation is to update postgresql-common to version 210 or later.
No, this vulnerability affects postgresql-common in general, but it is commonly used in Alpine Linux distributions.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-common.
