postgresql before versions 10.4, 9.6.9 is vulnerable in... · CVE-2018-1115 · GitHub Advisory Database · GitHub

postgresql before versions 10.4, 9.6.9 is vulnerable in...

Critical severity Unreviewed Published May 13, 2022 to the GitHub Advisory Database • Updated Feb 1, 2023

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.

References

Published by the National Vulnerability Database

May 10, 2018

Published to the GitHub Advisory Database May 13, 2022

Last updated Feb 1, 2023

Severity

Critical

9.1

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H