CVE-2017-8806

Name of the Vulnerable Software and Affected Versions postgresql-common versions prior to 181+deb9u1

Description The issue is related to the incorrect handling of symbolic links by the pg ctlcluster, pg createcluster, and pg upgradecluster scripts in the postgresql-common package for PostgreSQL. This could allow an attacker to impact data integrity by overwriting arbitrary files, resulting in a local denial of service.

Recommendations For versions prior to 181+deb9u1, update to version 181+deb9u1 or later to resolve the issue. As a temporary workaround, consider restricting access to the pg ctlcluster, pg createcluster, and pg upgradecluster scripts until a patch is available.