The vulnerability of the “pg_upgrade” command implementation in the PostgreSQL database management system allows a hacker to gain access to arbitrary files.

The vulnerability of the “pgupgrade” command in the PostgreSQL database management system is related to errors during the creation of temporary files in the current working directory. Exploiting this vulnerability can allow an attacker to gain access to arbitrary files...

MGASA-2018-0137 Updated postgresql packages fix security vulnerability

In postgresql 9.4.x before 9.4.16 and 9.6.x before 9.6.7, pgupgrade creates file in current working directory containing the output of pgdumpall -g under umask which was in effect when the user invoked pgupgrade, and not under 0077 which is normally used for other temporary files. This can allow ...

Vulnerability in client (CVE-2018-1053)

pgupgrade creates file of sensitive metadata under prevailing umask...