{"id":"CVE-2019-3466","year":2019,"sequence":3466,"component":"packaging","score":8.4,"cvss_version":"3.0","vector":"AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","first_published":"2019-12-04","source_url":"https://www.postgresql.org/support/security/CVE-2019-3466/","facts":{"affected":{"10":"10","11":"11","12":"12","9.4":"9.4","9.5":"9.5","9.6":"9.6"},"component":"packaging","cvss_version":"3.0","description_en":"A PostgreSQL superuser could escalate to root using a deficiency in the pg_ctlcluster command. pg_ctlcluster is a utility provided by the \"postgresql-common\" package that is installed with PostgreSQL on Debian and Ubuntu platforms.","first_published":"2019-12-04","fixed":{"10":"10.11","11":"11.6","12":"12.1","9.4":"9.4.25","9.5":"9.5.20","9.6":"9.6.16"},"id":"CVE-2019-3466","introduced":{},"published":{"10":"2019-12-04","11":"2019-12-04","12":"2019-12-04","9.4":"2019-12-04","9.5":"2019-12-04","9.6":"2019-12-04"},"score":8.4,"title":"pg_ctlcluster script in postgresql-common does not drop privileges when creating socket/statistics temporary directories","url":"https://www.postgresql.org/support/security/CVE-2019-3466/","vector":"AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H"},"reviewed_hash":"6a65a7884245936f6adaef8709d290d460e999dfce1ad78734fa7c9a324ed325","source_hash":"965b9e2323feab543f3cbeb74c418c3a5b43cbefc6594d2862ff0d24dcf8e6a2","text":null,"locales":["en"],"fixes":[{"major":"10","fixed_version":"10.11","introduced":null,"published_date":"2019-12-04","facts":{"fixed":"10.11","introduced":null,"published":"2019-12-04"}},{"major":"11","fixed_version":"11.6","introduced":null,"published_date":"2019-12-04","facts":{"fixed":"11.6","introduced":null,"published":"2019-12-04"}},{"major":"12","fixed_version":"12.1","introduced":null,"published_date":"2019-12-04","facts":{"fixed":"12.1","introduced":null,"published":"2019-12-04"}},{"major":"9.4","fixed_version":"9.4.25","introduced":null,"published_date":"2019-12-04","facts":{"fixed":"9.4.25","introduced":null,"published":"2019-12-04"}},{"major":"9.5","fixed_version":"9.5.20","introduced":null,"published_date":"2019-12-04","facts":{"fixed":"9.5.20","introduced":null,"published":"2019-12-04"}},{"major":"9.6","fixed_version":"9.6.16","introduced":null,"published_date":"2019-12-04","facts":{"fixed":"9.6.16","introduced":null,"published":"2019-12-04"}}],"legacy":[]}