CVE-2019-3466 - The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation

Back Back to CVE browser

HIGH

The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation

Published Nov 20, 2019

7.8

HIGH

CVSS 3.1

EPSS 0.50%

Description

The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.

Affected products

Vendor n/a Product postgresql-common (Debian-specific Postgres management tools) Default
n/a
- Version
  Versions before 210
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

postgresql-common (Debian-specific Postgres management tools)

n/a

Version	Status	Constraints
Versions before 210	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-269

Improper Privilege Management

References (2)

https://blog.mirch.io/2019/11/15/cve-2019-3466-debian-ubuntu-pg_ctlcluster-privilege-escalation/
x_refsource_MISCExploitPatchThird Party Advisory
https://usn.ubuntu.com/4194-2/
vendor-advisoryx_refsource_UBUNTU

Link	Providers	Tags
https://blog.mirch.io/2019/11/15/cve-2019-3466-debian-ubuntu-pg_ctlcluster-privilege-escalation/		x_refsource_MISCExploitPatchThird Party Advisory
https://usn.ubuntu.com/4194-2/		vendor-advisoryx_refsource_UBUNTU