CVE-2018-1053Not scoredCWE-377

CVE-2018-1053: The PostgreSQL Global Development Group postgresql vulnerability

The PostgreSQL Global Development Group · postgresql

Vendor fix available · Affected: The PostgreSQL Global Development Group postgresql · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.5%probability of exploitation in the next 30 days

42nd percentile

050100

Higher than 42% of scored CVEs

Not scored yet. The CVE record carries no CVSS score.

DescriptionCVE.org

In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

The PostgreSQL Global Development Group · postgresql9.3.x before 9.3.21; 9.4.x before 9.4.16; 9.5.x before 9.5.11; 9.6.x before 9.6.7; 10.x before 10.2

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: CWE-377 · File and Path Handling
Vendor: The PostgreSQL Global Development Group
Published: February 2018
Band: Unlikely (under 1%), February 2018

CoverageNo articles yet

No CyberSIXT article names CVE-2018-1053 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.