製品・ソフトウェアに関する情報

JVN脆弱性詳細

PostgreSQL におけるリンク解釈に関する脆弱性

Title	PostgreSQL におけるリンク解釈に関する脆弱性
Summary	PostgreSQL には、リンク解釈に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 9, 2017, midnight
Registration Date	Dec. 21, 2017, 3:45 p.m.
Last Update	Dec. 21, 2017, 3:45 p.m.

CVSS3.0 : 警告
Score	6.7
Vector	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS2.0 : 危険
Score	7.2
Vector	AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected System

PostgreSQL.org

PostgreSQL 10.1 未満の 10.x

PostgreSQL 9.2.24 未満の 9.2.x

PostgreSQL 9.3.20 未満の 9.3.x

PostgreSQL 9.4.15 未満の 9.4.x

PostgreSQL 9.5.10 未満の 9.5.x

PostgreSQL 9.6.6 未満の 9.6.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-12172	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12172
National Vulnerability Database (NVD)
2	CVE-2017-12172	https://nvd.nist.gov/vuln/detail/CVE-2017-12172

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-59	https://jvndb.jvn.jp/ja/cwe/CWE-59.html

ベンダー情報

No	Name	URL
PostgreSQL
1	PostgreSQL 10.1, 9.6.6, 9.5.10, 9.4.15, 9.3.20, and 9.2.24 released!	https://www.postgresql.org/about/news/1801/
2	Security Information	https://www.postgresql.org/support/security/

Change Log

No	Changed Details	Date of change
0	[2017年12月21日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2017-12172

Summary	PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.
Publication Date	Nov. 23, 2017, 4:29 a.m.
Registration Date	Jan. 26, 2021, 1:13 p.m.
Last Update	Nov. 21, 2024, 12:08 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:postgresql:postgresql:9.3.8:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.1:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.1:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.15:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.18:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.13:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.7:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.9:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.12:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.11:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.15:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.6:::::::*
cpe:2.3:a:postgresql:postgresql:9.6.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.11:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.8:::::::*
cpe:2.3:a:postgresql:postgresql:9.6.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.7:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.4:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.6:::::::*
cpe:2.3:a:postgresql:postgresql:9.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.6:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.4:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.12:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.10:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.21:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.10:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.1:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.13:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.6:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.10:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.7:::::::*
cpe:2.3:a:postgresql:postgresql:9.4:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.14:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.7:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.16:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.1:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.8:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.19:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.9:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.17:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.4:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.12:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.16:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.11:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.9:::::::*
cpe:2.3:a:postgresql:postgresql:9.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.17:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.14:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.20:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.6.1:::::::*
cpe:2.3:a:postgresql:postgresql:9.6:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.4:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.8:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.9:::::::*
cpe:2.3:a:postgresql:postgresql:9.6.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.6.4:::::::*
cpe:2.3:a:postgresql:postgresql:10:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.14:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.13:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.19:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.18:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.23:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.22:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/101949	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/101949	Third Party Advisory VDB Entry
3	http://www.securitytracker.com/id/1039752	Third Party Advisory VDB Entry
4	http://www.securitytracker.com/id/1039752	Third Party Advisory VDB Entry
5	https://access.redhat.com/errata/RHSA-2017:3402	Issue Tracking Third Party Advisory
6	https://access.redhat.com/errata/RHSA-2017:3402	Issue Tracking Third Party Advisory
7	https://access.redhat.com/errata/RHSA-2017:3403	Issue Tracking Third Party Advisory
8	https://access.redhat.com/errata/RHSA-2017:3403	Issue Tracking Third Party Advisory
9	https://access.redhat.com/errata/RHSA-2017:3404	Issue Tracking Third Party Advisory
10	https://access.redhat.com/errata/RHSA-2017:3404	Issue Tracking Third Party Advisory
11	https://access.redhat.com/errata/RHSA-2017:3405	Issue Tracking Third Party Advisory
12	https://access.redhat.com/errata/RHSA-2017:3405	Issue Tracking Third Party Advisory
13	https://www.postgresql.org/about/news/1801/	Issue Tracking Vendor Advisory
14	https://www.postgresql.org/about/news/1801/	Issue Tracking Vendor Advisory
15	https://www.postgresql.org/support/security/	Issue Tracking Vendor Advisory
16	https://www.postgresql.org/support/security/	Issue Tracking Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-59	リンク解釈の問題	https://cwe.mitre.org/data/definitions/59.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:postgresql:postgresql:9.3.8:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.1:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.1:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.15:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.18:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.13:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.7:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.9:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.12:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.11:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.15:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.6:::::::*
cpe:2.3:a:postgresql:postgresql:9.6.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.11:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.8:::::::*
cpe:2.3:a:postgresql:postgresql:9.6.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.7:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.4:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.6:::::::*
cpe:2.3:a:postgresql:postgresql:9.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.6:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.4:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.12:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.10:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.21:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.10:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.1:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.13:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.6:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.10:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.7:::::::*
cpe:2.3:a:postgresql:postgresql:9.4:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.14:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.7:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.16:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.1:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.8:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.19:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.9:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.17:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.4:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.12:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.16:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.11:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.9:::::::*
cpe:2.3:a:postgresql:postgresql:9.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.17:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.14:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.20:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.6.1:::::::*
cpe:2.3:a:postgresql:postgresql:9.6:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.4:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.8:::::::*
cpe:2.3:a:postgresql:postgresql:9.5.9:::::::*
cpe:2.3:a:postgresql:postgresql:9.6.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.6.4:::::::*
cpe:2.3:a:postgresql:postgresql:10:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.14:::::::*
cpe:2.3:a:postgresql:postgresql:9.4.13:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.19:::::::*
cpe:2.3:a:postgresql:postgresql:9.3.18:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.23:::::::*
cpe:2.3:a:postgresql:postgresql:9.2.22:::::::*