{"id":"CVE-2017-12172","title":"PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run…","summary":"PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run…","severity":"medium","cvss":6.7,"cvssVector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-59"],"vendor":"postgresql","product":"postgresql","affected":["postgresql = 9.2","postgresql = 9.2.1","postgresql = 9.2.2","postgresql = 9.2.3","postgresql = 9.2.4","postgresql = 9.2.5","postgresql = 9.2.6","postgresql = 9.2.7","postgresql = 9.2.8","postgresql = 9.2.9","postgresql = 9.2.10","postgresql = 9.2.11","postgresql = 9.2.12","postgresql = 9.2.13","postgresql = 9.2.14","postgresql = 9.2.15","postgresql = 9.2.16","postgresql = 9.2.17","postgresql = 9.2.18","postgresql = 9.2.19","postgresql = 9.2.20","postgresql = 9.2.21","postgresql = 9.2.22","postgresql = 9.2.23","postgresql = 9.3","postgresql = 9.3.1","postgresql = 9.3.2","postgresql = 9.3.3","postgresql = 9.3.4","postgresql = 9.3.5","postgresql = 9.3.6","postgresql = 9.3.7","postgresql = 9.3.8","postgresql = 9.3.9","postgresql = 9.3.10","postgresql = 9.3.11","postgresql = 9.3.12","postgresql = 9.3.13","postgresql = 9.3.14","postgresql = 9.3.15","postgresql = 9.3.16","postgresql = 9.3.17","postgresql = 9.3.18","postgresql = 9.3.19","postgresql = 9.4","postgresql = 9.4.1","postgresql = 9.4.2","postgresql = 9.4.3","postgresql = 9.4.4","postgresql = 9.4.5","postgresql = 9.4.6","postgresql = 9.4.7","postgresql = 9.4.8","postgresql = 9.4.9","postgresql = 9.4.10","postgresql = 9.4.11","postgresql = 9.4.12","postgresql = 9.4.13","postgresql = 9.4.14","postgresql = 9.5","postgresql = 9.5.1","postgresql = 9.5.2","postgresql = 9.5.3","postgresql = 9.5.4","postgresql = 9.5.5","postgresql = 9.5.6","postgresql = 9.5.7","postgresql = 9.5.8","postgresql = 9.5.9","postgresql = 9.6","postgresql = 9.6.1","postgresql = 9.6.2","postgresql = 9.6.3","postgresql = 9.6.4","postgresql = 9.6.5","postgresql = 10"],"published":"2017-11-22","updated":"2026-10-15","sourceUpdated":"2026-10-15T16:17:26.737","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2017-12172","references":[{"url":"http://www.securityfocus.com/bid/101949","label":"secalert@redhat.com"},{"url":"http://www.securitytracker.com/id/1039752","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2017:3402","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2017:3403","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2017:3404","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2017:3405","label":"secalert@redhat.com"},{"url":"https://www.postgresql.org/about/news/1801/","label":"secalert@redhat.com"},{"url":"https://www.postgresql.org/support/security/","label":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/101949","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1039752","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:3402","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:3403","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:3404","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:3405","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.postgresql.org/about/news/1801/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.postgresql.org/support/security/","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.00586,"epssPercentile":0.4784,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T15:51:47.114676Z"},"ingestedAt":"2026-10-15T16:13:10.920Z","slug":"CVE-2017-12172","body":"## Overview\n\nPostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.\n\n## Affected\n\n- `postgresql = 9.2`\n- `postgresql = 9.2.1`\n- `postgresql = 9.2.2`\n- `postgresql = 9.2.3`\n- `postgresql = 9.2.4`\n- `postgresql = 9.2.5`\n- `postgresql = 9.2.6`\n- `postgresql = 9.2.7`\n- `postgresql = 9.2.8`\n- `postgresql = 9.2.9`\n- `postgresql = 9.2.10`\n- `postgresql = 9.2.11`\n- `postgresql = 9.2.12`\n- `postgresql = 9.2.13`\n- `postgresql = 9.2.14`\n- `postgresql = 9.2.15`\n- `postgresql = 9.2.16`\n- `postgresql = 9.2.17`\n- `postgresql = 9.2.18`\n- `postgresql = 9.2.19`\n- `postgresql = 9.2.20`\n- `postgresql = 9.2.21`\n- `postgresql = 9.2.22`\n- `postgresql = 9.2.23`\n- `postgresql = 9.3`\n- `postgresql = 9.3.1`\n- `postgresql = 9.3.2`\n- `postgresql = 9.3.3`\n- `postgresql = 9.3.4`\n- `postgresql = 9.3.5`\n- `postgresql = 9.3.6`\n- `postgresql = 9.3.7`\n- `postgresql = 9.3.8`\n- `postgresql = 9.3.9`\n- `postgresql = 9.3.10`\n- `postgresql = 9.3.11`\n- `postgresql = 9.3.12`\n- `postgresql = 9.3.13`\n- `postgresql = 9.3.14`\n- `postgresql = 9.3.15`\n- `postgresql = 9.3.16`\n- `postgresql = 9.3.17`\n- `postgresql = 9.3.18`\n- `postgresql = 9.3.19`\n- `postgresql = 9.4`\n- `postgresql = 9.4.1`\n- `postgresql = 9.4.2`\n- `postgresql = 9.4.3`\n- `postgresql = 9.4.4`\n- `postgresql = 9.4.5`\n- `postgresql = 9.4.6`\n- `postgresql = 9.4.7`\n- `postgresql = 9.4.8`\n- `postgresql = 9.4.9`\n- `postgresql = 9.4.10`\n- `postgresql = 9.4.11`\n- `postgresql = 9.4.12`\n- `postgresql = 9.4.13`\n- `postgresql = 9.4.14`\n- `postgresql = 9.5`\n- `postgresql = 9.5.1`\n- `postgresql = 9.5.2`\n- `postgresql = 9.5.3`\n- `postgresql = 9.5.4`\n- `postgresql = 9.5.5`\n- `postgresql = 9.5.6`\n- `postgresql = 9.5.7`\n- `postgresql = 9.5.8`\n- `postgresql = 9.5.9`\n- `postgresql = 9.6`\n- `postgresql = 9.6.1`\n- `postgresql = 9.6.2`\n- `postgresql = 9.6.3`\n- `postgresql = 9.6.4`\n- `postgresql = 9.6.5`\n- `postgresql = 10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":36.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222585,"id":"CVE-2017-12172","ts":1792084750136,"field":"cvss","old":null,"new":"6.7"},{"seq":222584,"id":"CVE-2017-12172","ts":1792084750136,"field":"severity","old":"none","new":"medium"}]}