cbcvebase.
CVE-2018-1053
published 2018-02-09

CVE-2018-1053: In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current…

PriorityP430high7CVSS 3.0
AVLACHPRLUINSUCHIHAH
EPSS
0.49%
39.0th percentile
In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.

Affected

27 ranges· showing 25
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
postgresqlpostgresql
postgresqlpostgresql
postgresqlpostgresql>= 0 < 10.2-r010.2-r0
postgresqlpostgresql>= 0 < 10.2-r010.2-r0
postgresqlpostgresql>= 0 < 10.2-r010.2-r0
postgresqlpostgresql>= 0 < 10.2-r010.2-r0
postgresqlpostgresql>= 0 < 10.2-r010.2-r0
postgresqlpostgresql>= 0 < 9.5.11-r09.5.11-r0
postgresqlpostgresql>= 0 < 9.6.7-r09.6.7-r0
postgresqlpostgresql>= 0 < 9.6.7-r09.6.7-r0
postgresqlpostgresql>= 0 < 10.2-r010.2-r0
postgresqlpostgresql>= 0 < 10.2-r010.2-r0
postgresqlpostgresql>= 0 < 10.2-r010.2-r0
postgresqlpostgresql>= 9.3.0 < 9.3.219.3.21
postgresqlpostgresql>= 9.4.0 < 9.4.169.4.16
postgresqlpostgresql>= 9.5.0 < 9.5.119.5.11
postgresqlpostgresql>= 9.6.0 < 9.6.79.6.7
redhatcloudforms
the_postgresql_global_development_grouppostgresql
the_postgresql_global_development_grouppostgresql
the_postgresql_global_development_grouppostgresql

CVSS provenance

nvdv3.07.0HIGHCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.03.3LOWAV:L/AC:M/Au:N/C:P/I:P/A:N
osv7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.