CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
26.7%
CentOS Errata and Security Advisory CESA-2017:3402
PostgreSQL is an advanced object-relational database management system (DBMS).
Security Fix(es):
Note: This patch drops the script privileges from root to the postgres user. Therefore, this update works properly only if the postgres user has write access to the postgres’ home directory, such as the one in the default configuration (/var/lib/pgsql).
Red Hat would like to thank the PostgreSQL project for reporting CVE-2017-12172. The CVE-2017-15097 issue was discovered by Pedro Barbosa (Red Hat) and the PostgreSQL project. Upstream acknowledges Antoine Scemama (Brainloop) as the original reporter of these issues.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2017-December/084852.html
Affected packages:
postgresql
postgresql-contrib
postgresql-devel
postgresql-docs
postgresql-libs
postgresql-plperl
postgresql-plpython
postgresql-pltcl
postgresql-server
postgresql-static
postgresql-test
postgresql-upgrade
Upstream details at:
https://access.redhat.com/errata/RHSA-2017:3402
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 7 | i686 | postgresql | < 9.2.23-3.el7_4 | postgresql-9.2.23-3.el7_4.i686.rpm |
CentOS | 7 | x86_64 | postgresql | < 9.2.23-3.el7_4 | postgresql-9.2.23-3.el7_4.x86_64.rpm |
CentOS | 7 | x86_64 | postgresql-contrib | < 9.2.23-3.el7_4 | postgresql-contrib-9.2.23-3.el7_4.x86_64.rpm |
CentOS | 7 | i686 | postgresql-devel | < 9.2.23-3.el7_4 | postgresql-devel-9.2.23-3.el7_4.i686.rpm |
CentOS | 7 | x86_64 | postgresql-devel | < 9.2.23-3.el7_4 | postgresql-devel-9.2.23-3.el7_4.x86_64.rpm |
CentOS | 7 | x86_64 | postgresql-docs | < 9.2.23-3.el7_4 | postgresql-docs-9.2.23-3.el7_4.x86_64.rpm |
CentOS | 7 | i686 | postgresql-libs | < 9.2.23-3.el7_4 | postgresql-libs-9.2.23-3.el7_4.i686.rpm |
CentOS | 7 | x86_64 | postgresql-libs | < 9.2.23-3.el7_4 | postgresql-libs-9.2.23-3.el7_4.x86_64.rpm |
CentOS | 7 | x86_64 | postgresql-plperl | < 9.2.23-3.el7_4 | postgresql-plperl-9.2.23-3.el7_4.x86_64.rpm |
CentOS | 7 | x86_64 | postgresql-plpython | < 9.2.23-3.el7_4 | postgresql-plpython-9.2.23-3.el7_4.x86_64.rpm |
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
26.7%