CVE-2019-3466: High severity PostgreSQL postgresql-common vulnerability
Published Nov 20, 2019
·Updated
Last updated 25 August 2025
Other sources
The pgctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.
— Launchpad
Affected Software
8 affected componentsFixes available
PostgreSQL postgresql-common<210
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=19.04
Canonical Ubuntu Linux=19.10
Debian Debian Linux=9.0
Debian Debian Linux=10.0
debian/postgresql-common
225+deb11u1248+deb12u1278289
Remediation
Event History
Nov 20, 2019
CVE Published
via MITRE·05:16 PM
Data Sourced
via MITRE·05:16 PM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·11:29 PM
Description
Feb 23, 2026
Data Sourced
via Ubuntu·03:54 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·03:55 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is CVE-2019-3466?
CVE-2019-3466 is a vulnerability that allows local privilege escalation in the pg_ctlcluster script in postgresql-common.
2
How severe is CVE-2019-3466?
CVE-2019-3466 has a severity rating of 7.8, which is considered high.
3
Which software versions are affected by CVE-2019-3466?
Versions of postgresql-common prior to 210 are affected by CVE-2019-3466.
4
How can I fix CVE-2019-3466?
Apply the necessary updates and patches provided by the software vendor to fix CVE-2019-3466.
5
Where can I find more information about CVE-2019-3466?
You can find more information about CVE-2019-3466 at the following references: <link1>, <link2>, <link3>