CVE-2017-8806: postgresql Link Following
CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2017-8806DEBIAN-CVE-2017-8806DLA-1169-1DSA-4029-1CGA-2838-v66r-392vCGA-2qjx-wvqx-4m99CGA-2w24-535v-9h87CGA-3jrr-jpm3-45jmCGA-3w4f-wwg8-pwxvCGA-3wpr-rfpw-6hwvCGA-44rm-75cp-9827CGA-4757-9f56-w8w8CGA-479r-2q7p-fr2xCGA-4gg5-7qm5-xgxhCGA-4mxw-hp39-p6p5CGA-4wrv-m6pm-ww4rCGA-4xq7-rm9q-3pf5CGA-5hqm-xhwx-8x4mCGA-5m86-g48j-hchgCGA-6c2c-jf8v-2r8wCGA-6mq4-j369-483qCGA-73pm-9gv3-fwhfCGA-7vw4-vx94-95grCGA-89h4-3fjf-7h42CGA-8j9r-hr4h-wxxhCGA-8xg4-vx37-rg3qCGA-94qc-mfxp-v75vCGA-9hgc-8w4x-g7qwCGA-9qc6-p73w-54mrCGA-9w99-r47j-9vfmCGA-9wx8-vh5c-fhj2CGA-c7r2-48xv-qvxfCGA-cr65-9gq3-wc59CGA-cx3g-j3rh-vr8mCGA-fww7-jfv7-x5pgCGA-g745-8w7p-g9f9CGA-gmmp-63q5-p3gwCGA-gq78-rqrx-8c5pCGA-gqj9-rw74-gj87CGA-h6x7-f9r2-g82qCGA-hq6q-wh72-7rp7CGA-hx24-gr42-69mmCGA-j76g-v588-v84qCGA-jf7f-h2qw-g6j6CGA-jq9p-6jgp-3v7fCGA-m243-8f6g-c8chCGA-m595-p5fr-3fpcCGA-p729-56w6-gxjmCGA-p863-95q4-v3g4CGA-pfr3-w8gc-9cq6CGA-pwgx-m4fx-5vg8CGA-q3hq-xq98-8pxcCGA-q542-9738-3p5wCGA-qc3f-77jh-vvc8CGA-r49f-6258-9rvfCGA-rc9r-hr5p-r8hmCGA-rf9q-g7jv-jjfxCGA-rpjr-gp8w-q465CGA-w5f3-6rfg-mjm6CGA-wp9m-w87r-qg2qCGA-x42p-72cm-5vq2CGA-xmc6-h2hr-m5wvCGA-2hfh-2m84-8m46CGA-4qq6-v79j-2fxpCGA-82xp-g7j2-56xvCGA-848h-fvmg-5h7mCGA-2vjx-23jm-4246GHSA-xg92-g8h7-v7r4CGA-9wqw-gwwq-gr88CGA-f5r3-3g7w-gx6jCGA-gjwx-g4vw-652cCGA-j3gp-hf4g-j427CGA-jg6x-j785-r59pCGA-jpwr-ff8v-gqh4CGA-p9rj-4ffw-q98vCGA-v9j2-qcgh-6rvvCGA-xpg6-xfqr-h386
Published 13-11-2017Last modified 05-08-2024
Vulnerability summary
CVE-2017-8806 is a medium (CVSS 5.5) Link Following vulnerability in postgresql. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.8% of scored vulnerabilities.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
0.42%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 9Timeline
- 13-11-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.
CVSS metrics
7 scores · 5 sources · 3 versionsMedium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Medium 5.5Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NSourcesSingle source
Low 3.6Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:N/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
0.00 pp
From 0.42% on 19-09-2026
19-09-202619-10-2026
EPSS score0.42%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard32 products
- ecpg-13< 13.20-r0
- ecpg-14< 14.17-r0
- libecpg-13< 13.20-r0
- libecpg-13-dev< 13.20-r0
- libecpg-14< 14.17-r0
Wolfi26 products
- libecpg-13< 13.20-r0
- libecpg-14< 14.17-r0
- libpq-13< 13.20-r0
- libpq-14< 14.17-r0
- neonAll versions (No fix recorded)
Debian1 product
- postgresql-common< 188 | < 165+deb8u3 | < 181+deb9u1 | < 134wheezy6
Postgresql1 product
Ubuntu1 product
- postgresql-common< 154ubuntu1.1 | < 173ubuntu0.1
5 vendors · 61 products
References
9 links
metadata.ftp-master.debian.org/changelogs/…X Refsource CONFIRMBroken LinkIssue TrackingThird Party AdvisoryAdvisoryREPORTWEB- www.debian.org/security/2017/dsa-4029X Refsource CONFIRMIssue TrackingThird Party AdvisoryAdvisoryREPORT