CVE-2019-3466

Name of the Vulnerable Software and Affected Versions postgresql-common versions prior to 210

Description The issue is related to the pg ctlcluster script in postgresql-common, which failed to drop privileges when creating temporary directories for sockets and statistics. This could lead to local privilege escalation. An attacker could exploit this issue to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For versions prior to 210, update to version 210 or later to resolve the issue. As a temporary workaround, consider restricting access to the pg ctlcluster script to minimize the risk of exploitation.