CVE-2017-8806: Medium severity postgresql vulnerability
Last updated 24 July 2024
Other sources
The Debian pgctlcluster, pgcreatecluster, and pgupgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8806?
CVE-2017-8806 is considered to have a moderate severity level due to its potential impact on the security of PostgreSQL installations in Debian and Ubuntu.
How do I fix CVE-2017-8806?
To fix CVE-2017-8806, you should upgrade the postgresql-common package to version 181+deb9u1 or later.
Which systems are affected by CVE-2017-8806?
CVE-2017-8806 affects Debian and Ubuntu systems that use PostgreSQL with vulnerable versions of the postgresql-common package.
Are there any workarounds for CVE-2017-8806?
A workaround for CVE-2017-8806 includes ensuring that symbolic links are handled securely in your PostgreSQL configuration.
What types of PostgreSQL installations are impacted by CVE-2017-8806?
CVE-2017-8806 impacts installations of PostgreSQL that rely on Debian's postgresql-common scripts for managing clusters.