Description (CNA)
The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / postgresql-common (Debian-specific Postgres management tools) | affected Versions before 210 |
CWE
No CWE identifiers supplied.
References
- https://blog.mirch.io/2019/11/15/cve-2019-3466-debian-ubuntu-pg_ctlcluster-privilege-escalation/
- https://usn.ubuntu.com/4194-2/
ADP enrichment
No English description supplied.