CVE-2017-8806

The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
debianCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 45%
VendorProductVersion
postgresqlpostgresql
-
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
postgresql-common
bullseye
225+deb11u1
fixed
bookworm
248
fixed
sid
265
fixed
trixie
265
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
postgresql-common
artful
Fixed 184ubuntu1.1
released
zesty
Fixed 179ubuntu0.1
released
xenial
Fixed 173ubuntu0.1
released
trusty
Fixed 154ubuntu1.1
released
Common Weakness Enumeration
References
http://metadata.ftp-master.debian.org/changelogs/main/p/postgresql-common/postgresql-common_181+deb9u1_changelog
http://www.securityfocus.com/bid/101810
https://usn.ubuntu.com/usn/usn-3476-1/
https://www.debian.org/security/2017/dsa-4029
http://metadata.ftp-master.debian.org/changelogs/main/p/postgresql-common/postgresql-common_181+deb9u1_changelog
http://www.securityfocus.com/bid/101810
https://usn.ubuntu.com/usn/usn-3476-1/
https://www.debian.org/security/2017/dsa-4029