Description
Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker with access to the postgres user account could use these flaws to obtain root access on the server machine.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | postgresql init script | all | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | postgresql +11 | 9.2.23-3.el7_4 | RHSA-2017:3402 |
| RHEL 3 | rh-postgresql94-postgresql +11 | 9.4.14-2.el6 | RHSA-2017:3403 |
| RHEL 3 | rh-postgresql95-postgresql +10 | 9.5.9-4.el6 | RHSA-2017:3404 |
| RHEL 3 | rh-postgresql96-postgresql +13 | 9.6.5-2.el6 | RHSA-2017:3405 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | rh-postgresql95-postgresql +10 | 9.5.9-4.el7 | RHSA-2017:3404 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | postgresql +11 | 9.2.23-3.el7_4 | ELSA-2017-3402 |
Advisories 6
- RHSA-2017:3404 Red Hat Security Advisory: rh-postgresql95-postgresql security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2017:3405 Red Hat Security Advisory: rh-postgresql96-postgresql security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2017:3402 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2017:3403 Red Hat Security Advisory: rh-postgresql94-postgresql security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- WID-SEC-2024-0143 PostgreSQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 31, 2025
- ELSA-2017-3402 Moderate: postgresql security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 7, 2017
References
- RHSA-2017:3402 vendor-advisory
- RHSA-2017:3403 vendor-advisory
- RHSA-2017:3405 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15097
- 1039983 vdb-entry
- RHSA-2017:3404 vendor-advisory