REDHAT-BUG-1508985: Medium severity postgresql vulnerability

Published Nov 2, 2017

Updated

PostgreSQL runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. Red Hat provides scripts for starting the database server during system boot and for initializing the database. These implementations use file names that the database superuser can replace with symbolic links. As root, the scripts open(), chmod() and/or chown() the log and data files. These issues often suffice for the database superuser to escalate to root privileges when root starts the server or initializes the database.

Affected Software

1 affected component

Red Hat PostgreSQL

Event History

Nov 2, 2017

Data Sourced

via Red Hat·03:40 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1508985?

The severity of REDHAT-BUG-1508985 is considered high due to the potential for database superusers to execute arbitrary code.

How do I fix REDHAT-BUG-1508985?

To fix REDHAT-BUG-1508985, you should update PostgreSQL to the latest version provided by Red Hat that addresses this vulnerability.

What are the risks associated with REDHAT-BUG-1508985?

The risks associated with REDHAT-BUG-1508985 include unauthorized access to system resources and potential data breaches due to arbitrary code execution.

Who is affected by REDHAT-BUG-1508985?

Users of Red Hat's PostgreSQL who have database superusers can potentially be affected by REDHAT-BUG-1508985.

What version of PostgreSQL is impacted by REDHAT-BUG-1508985?

All versions of Red Hat PostgreSQL up to the patched releases may be impacted by REDHAT-BUG-1508985.