CVE-2017-14798
7.0
Vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.0 / Impact: 5.9
Source: NVD
Description
A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.
Affected (2)
Products: Postgresql: Postgresql · Suse: Suse Linux Enterprise Server
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 9.4-0.5.3.1 |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 11 sp3 |
Related CWEs
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
CWE-61
UNIX Symbolic Link (Symlink) Following
The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
References (8)
Source: security@opentext.com
Source: security@opentext.com
Source: security@opentext.com
Source: security@opentext.com
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Timeline
No history available yet.