Skip to content
OpenAdvisories
Unscored CVE-2017-8806 EUVD-2017-17749GHSA-xg92-g8h7-v7r4

The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 18…

Published Nov 13, 2017 · Updated Aug 5, 2024 · Assigned by debian

Package: libecpg-13 Package: libecpg-14 Package: libpq-13 Package: libpq-14 Package: postgresql-13 Package: postgresql-13-base Package: postgresql-13-client Package: postgresql-13-client-base Package: postgresql-13-contrib Package: postgresql-13-dev Package: postgresql-13-oci-entrypoint Package: postgresql-13-oci-entrypoint-base Package: postgresql-14 Package: postgresql-14-base Package: postgresql-14-client Package: postgresql-14-client-base Package: postgresql-14-contrib Package: postgresql-14-dev Package: postgresql-14-oci-entrypoint Package: postgresql-14-oci-entrypoint-base Package: postgresql-18 Package: postgresql-common Package: postgresql-common Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.

Affected products

VendorProductAffectedFixed
— PostgreSQL-related scripts that are specific to Debian and Ubuntu PostgreSQL-related scripts that are specific to Debian and Ubuntu —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 postgresql-common 188 —
Debian 13 postgresql-common 188 —
Debian 12 postgresql-common 188 —
Debian 9 postgresql-common 181+deb9u1 DSA-4029-1
Debian 8 postgresql-common 165+deb8u3 DSA-4029-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Debian 7 postgresql-common 134wheezy6 DLA-1169-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS postgresql-common 173ubuntu0.1 USN-3476-1
Ubuntu 14.04 LTS postgresql-common 154ubuntu1.1 USN-3476-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling libpq-13 +9 13.20-r0 —
Wolfi rolling libpq-14 +9 14.17-r0 —
Wolfi rolling postgresql-18 18.1-r0 —

Advisories 4

References