Vulnerability in PostgreSQL
CVE-2018-1053
In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (39.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 39.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- PostgreSQL — versions 10.0, 10.1
- The PostgreSQL Global Development Group — versions 9.4.x before 9.4.16, 9.5.x before 9.5.11, 10.x before 10.2
- Canonical Ubuntu Linux — versions 14.04, 16.04, 17.10
- Debian Linux — versions 7.0
- Red Hat Cloudforms — versions 4.6
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.postgresql.org/about/news/1829/ (Patch, Third Party Advisory, Release Notes)
- access.redhat.com/errata/RHSA-2018:2511 (vendor-advisory, Third Party Advisory)
- lists.debian.org/debian-lts-announce/2018/02/msg00006.html (mailing-list, Mailing List, Third Party Advisory)
- access.redhat.com/errata/RHSA-2018:2566 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2018:3816 (vendor-advisory, Third Party Advisory)
- www.securityfocus.com/bid/102986 (VDB Entry, Third Party Advisory, vdb-entry)
- usn.ubuntu.com/3564-1/ (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-1053?
- CVE-2018-1053 is a high-severity vulnerability in PostgreSQL, classified under Insecure Temporary File. CVSS score: 7.0/10. Published 2018-02-09.
- How severe is CVE-2018-1053?
- High severity. CVSS v3 base score is 7.0 out of 10.
- Is CVE-2018-1053 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.