Description
PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | postgresql | 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, 9.2.x before 9.2.24 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | postgresql +11 | 9.2.23-3.el7_4 | RHSA-2017:3402 |
| RHEL 3 | rh-postgresql94-postgresql +11 | 9.4.14-2.el6 | RHSA-2017:3403 |
| RHEL 3 | rh-postgresql95-postgresql +10 | 9.5.9-4.el6 | RHSA-2017:3404 |
| RHEL 3 | rh-postgresql96-postgresql +13 | 9.6.5-2.el6 | RHSA-2017:3405 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | rh-postgresql95-postgresql +10 | 9.5.9-4.el7 | RHSA-2017:3404 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | postgresql94 +1 | 9.4.15-21.13.1 | SUSE-SU-2018:0081-1 |
| SLES 11 SP4 | postgresql94 +1 | 9.4.15-0.23.10.1 | SUSE-SU-2018:0077-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP2 | postgresql94 | 9.4.15-21.13.1 | SUSE-SU-2018:0081-1 |
| SLES for SAP 11 SP4 | postgresql94 +1 | 9.4.15-0.23.10.1 | SUSE-SU-2018:0077-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | postgresql +11 | 9.2.23-3.el7_4 | ELSA-2017-3402 |
Advisories 8
- RHSA-2017:3404 Red Hat Security Advisory: rh-postgresql95-postgresql security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2017:3405 Red Hat Security Advisory: rh-postgresql96-postgresql security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2017:3402 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2017:3403 Red Hat Security Advisory: rh-postgresql94-postgresql security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- SUSE-SU-2018:0077-1 Security update for postgresql94 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:0081-1 Security update for postgresql94 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0143 PostgreSQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 31, 2025
- ELSA-2017-3402 Moderate: postgresql security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 7, 2017
References
- RHSA-2017:3402 vendor-advisory
- 101949 vdb-entry
- RHSA-2017:3403 vendor-advisory
- RHSA-2017:3405 vendor-advisory
- https://www.postgresql.org/support/security/
- 1039752 vdb-entry
- https://www.postgresql.org/about/news/1801/
- RHSA-2017:3404 vendor-advisory