CVE-2018-1115
criticalpostgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than…
Vendor / product: Postgresql — postgresql
postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.
CVSS
9.1
9.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2018-05-10 19:29
Modified: 2026-10-08 22:16
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
postgresql / postgresql <9.6.9, ≥10.0 <10.4
opensuse / leap 15.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1115
Patch / mitigation: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1115
References
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html secalert@redhat.com
- http://www.securityfocus.com/bid/104285 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2018:2565 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2018:2566 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1115 secalert@redhat.com
- https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commitdiff%3Bh=7b34740 secalert@redhat.com
- https://security.gentoo.org/glsa/201810-08 secalert@redhat.com
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html af854a3a-2127-422b-91ae-364da2661108
- http://www.securityfocus.com/bid/104285 af854a3a-2127-422b-91ae-364da2661108
- https://access.redhat.com/errata/RHSA-2018:2565 af854a3a-2127-422b-91ae-364da2661108
- https://access.redhat.com/errata/RHSA-2018:2566 af854a3a-2127-422b-91ae-364da2661108
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1115 af854a3a-2127-422b-91ae-364da2661108
- https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commitdiff%3Bh=7b34740 af854a3a-2127-422b-91ae-364da2661108
- https://security.gentoo.org/glsa/201810-08 af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗