CVE catalog

CVE-2018-1053

ALPINE-CVE-2018-1053

[CVE catalog]

Severity
Medium · CVSS 6.7CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.48% · Oct 25, 2026

In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Alpinepostgresql3.1010.2-r0fixed
Alpinepostgresql3.1110.2-r0fixed
Alpinepostgresql3.1210.2-r0fixed
Alpinepostgresql3.1310.2-r0fixed
Alpinepostgresql3.1410.2-r0fixed
Alpinepostgresql3.49.5.11-r0fixed
Alpinepostgresql3.59.6.7-r0fixed
Alpinepostgresql3.69.6.7-r0fixed
Alpinepostgresql3.710.2-r0fixed
Alpinepostgresql3.810.2-r0fixed
Alpinepostgresql3.910.2-r0fixed
Alpinepostgresql143.1510.2-r0fixed
Alpinepostgresql143.1610.2-r0fixed
Alpinepostgresql143.1710.2-r0fixed
Alpinepostgresql143.1810.2-r0fixed
Alpinepostgresql153.1710.2-r0fixed
Alpinepostgresql153.1810.2-r0fixed
Alpinepostgresql153.1910.2-r0fixed
Alpinepostgresql153.2010.2-r0fixed
Ubuntupostgresql-9.314.049.3.1-1vulnerable
Ubuntupostgresql-9.314.049.3.2-1vulnerable
Ubuntupostgresql-9.314.049.3.2-1ubuntu1vulnerable
Ubuntupostgresql-9.314.049.3.2-1ubuntu2vulnerable
Ubuntupostgresql-9.314.049.3.3-1vulnerable
Ubuntupostgresql-9.314.049.3.3-1bzr1vulnerable
Ubuntupostgresql-9.314.049.3.3-1bzr2vulnerable
Ubuntupostgresql-9.314.049.3.4-1vulnerable
Ubuntupostgresql-9.314.049.3.5-0ubuntu0.14.04.1vulnerable
Ubuntupostgresql-9.314.049.3.6-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.7-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.8-0ubuntu0.4.04vulnerable
Ubuntupostgresql-9.314.049.3.9-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.10-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.11-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.12-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.13-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.14-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.15-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.16-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.17-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.18-0ubuntu0.14.04.1vulnerable
Ubuntupostgresql-9.314.049.3.19-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.20-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.21-0ubuntu0.14.04fixed
Ubuntupostgresql-9.516.049.5.0-1vulnerable
Ubuntupostgresql-9.516.049.5.0-2vulnerable
Ubuntupostgresql-9.516.049.5.0-3vulnerable
Ubuntupostgresql-9.516.049.5.1-1vulnerable
Ubuntupostgresql-9.516.049.5.2-1vulnerable
Ubuntupostgresql-9.516.049.5.3-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.516.049.5.4-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.516.049.5.5-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.516.049.5.6-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.516.049.5.7-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.516.049.5.8-0ubuntu0.16.04.1vulnerable
Ubuntupostgresql-9.516.049.5.9-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.516.049.5.10-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.516.049.5.11-0ubuntu0.16.04fixed
Ubuntupostgresql-9.314.049.3.1-1vulnerable
Ubuntupostgresql-9.314.049.3.2-1vulnerable
Ubuntupostgresql-9.314.049.3.2-1ubuntu1vulnerable
Ubuntupostgresql-9.314.049.3.2-1ubuntu2vulnerable
Ubuntupostgresql-9.314.049.3.3-1vulnerable
Ubuntupostgresql-9.314.049.3.3-1bzr1vulnerable
Ubuntupostgresql-9.314.049.3.3-1bzr2vulnerable
Ubuntupostgresql-9.314.049.3.4-1vulnerable
Ubuntupostgresql-9.314.049.3.5-0ubuntu0.14.04.1vulnerable
Ubuntupostgresql-9.314.049.3.6-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.7-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.8-0ubuntu0.4.04vulnerable
Ubuntupostgresql-9.314.049.3.9-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.10-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.11-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.12-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.13-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.14-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.15-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.16-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.17-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.18-0ubuntu0.14.04.1vulnerable
Ubuntupostgresql-9.314.049.3.19-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.20-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.314.049.3.21-0ubuntu0.14.04fixed
Ubuntupostgresql-9.516.049.5.0-1vulnerable
Ubuntupostgresql-9.516.049.5.0-2vulnerable
Ubuntupostgresql-9.516.049.5.0-3vulnerable
Ubuntupostgresql-9.516.049.5.1-1vulnerable
Ubuntupostgresql-9.516.049.5.2-1vulnerable
Ubuntupostgresql-9.516.049.5.3-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.516.049.5.4-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.516.049.5.5-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.516.049.5.6-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.516.049.5.7-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.516.049.5.8-0ubuntu0.16.04.1vulnerable
Ubuntupostgresql-9.516.049.5.9-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.516.049.5.10-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.516.049.5.11-0ubuntu0.16.04fixed
Debianpostgresql-9.179.1.10-0wheezy1vulnerable
Debianpostgresql-9.179.1.10-1vulnerable
Debianpostgresql-9.179.1.11-0wheezy1vulnerable
Debianpostgresql-9.179.1.11-1vulnerable
Debianpostgresql-9.179.1.11-1~bpo60+1vulnerable
Debianpostgresql-9.179.1.11-2vulnerable
Debianpostgresql-9.179.1.12-0wheezy1vulnerable
Debianpostgresql-9.179.1.12-0wheezy1~bpo60+1vulnerable
Debianpostgresql-9.179.1.12-1vulnerable
Debianpostgresql-9.179.1.13-0wheezy1vulnerable
Debianpostgresql-9.179.1.13-0wheezy1~bpo60+1vulnerable
Debianpostgresql-9.179.1.13-1vulnerable
Debianpostgresql-9.179.1.14-0+deb7u1vulnerable
Debianpostgresql-9.179.1.14-0wheezy1vulnerable
Debianpostgresql-9.179.1.15-0+deb7u1vulnerable
Debianpostgresql-9.179.1.15-0+deb7u1~bpo60+1vulnerable
Debianpostgresql-9.179.1.16-0+deb7u1vulnerable
Debianpostgresql-9.179.1.16-0+deb7u2vulnerable
Debianpostgresql-9.179.1.17-0+deb7u1vulnerable
Debianpostgresql-9.179.1.18-0+deb7u1vulnerable
Debianpostgresql-9.179.1.19-0+deb7u1vulnerable
Debianpostgresql-9.179.1.20-0+deb7u1vulnerable
Debianpostgresql-9.179.1.21-0+deb7u1vulnerable
Debianpostgresql-9.179.1.22-0+deb7u1vulnerable
Debianpostgresql-9.179.1.23-0+deb7u1vulnerable
Debianpostgresql-9.179.1.24-0+deb7u1vulnerable
Debianpostgresql-9.179.1.24lts2-0+deb7u1vulnerable
Debianpostgresql-9.179.1.9-1vulnerable
Debianpostgresql-9.179.1.9-2vulnerable
Debianpostgresql-9.179.1.9-3vulnerable
Debianpostgresql-9.179.1.9-4vulnerable
Debianpostgresql-9.179.1.9-5vulnerable
Debianpostgresql-9.179.1.24lts2-0+deb7u2fixed
Susepostgresql94linux enterprise desktop 12 sp29.4.16-21.16.1fixed
Susepostgresql94linux enterprise server for raspberry pi 12 sp29.4.16-21.16.1fixed
Susepostgresql94-libslinux enterprise software development kit 12 sp29.4.16-21.16.1fixed
Susepostgresql94linux enterprise server 12 sp29.4.16-21.16.1fixed
Susepostgresql94linux enterprise server for sap applications 12 sp29.4.16-21.16.1fixed
Susepostgresql96linux enterprise desktop 12 sp29.6.7-3.13.1fixed
Susepostgresql96-libslinux enterprise desktop 12 sp29.6.7-3.13.1fixed
Susepostgresql96linux enterprise desktop 12 sp39.6.7-3.13.1fixed
Susepostgresql96-libslinux enterprise desktop 12 sp39.6.7-3.13.1fixed
Susepostgresql96linux enterprise server for raspberry pi 12 sp29.6.7-3.13.1fixed
Susepostgresql96-libslinux enterprise server for raspberry pi 12 sp29.6.7-3.13.1fixed
Susepostgresql96-libslinux enterprise software development kit 12 sp29.6.7-3.13.1fixed
Susepostgresql96-libslinux enterprise software development kit 12 sp39.6.7-3.13.1fixed
Susepostgresql96linux enterprise server 12 sp29.6.7-3.13.1fixed
Susepostgresql96-libslinux enterprise server 12 sp29.6.7-3.13.1fixed
Susepostgresql96linux enterprise server for sap applications 12 sp29.6.7-3.13.1fixed
Susepostgresql96-libslinux enterprise server for sap applications 12 sp29.6.7-3.13.1fixed
Susepostgresql96linux enterprise server 12 sp39.6.7-3.13.1fixed
Susepostgresql96-libslinux enterprise server 12 sp39.6.7-3.13.1fixed
Susepostgresql96linux enterprise server for sap applications 12 sp39.6.7-3.13.1fixed
Susepostgresql96-libslinux enterprise server for sap applications 12 sp39.6.7-3.13.1fixed
Susepostgresql94-libslinux enterprise software development kit 11 sp49.4.16-0.23.13.2fixed
Susepostgresql94linux enterprise server 11 sp49.4.16-0.23.13.2fixed
Susepostgresql94-libslinux enterprise server 11 sp49.4.16-0.23.13.2fixed
Susepostgresql94linux enterprise server for sap applications 11 sp49.4.16-0.23.13.2fixed
Susepostgresql94-libslinux enterprise server for sap applications 11 sp49.4.16-0.23.13.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Alpinepostgresqlapk3.1010.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresqlapk3.1110.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresqlapk3.1210.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresqlapk3.1310.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresqlapk3.1410.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresqlapk3.49.5.11-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresqlapk3.59.6.7-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresqlapk3.69.6.7-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresqlapk3.710.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresqlapk3.810.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresqlapk3.910.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresql14apk3.1510.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresql14apk3.1610.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresql14apk3.1710.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresql14apk3.1810.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresql15apk3.1710.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresql15apk3.1810.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresql15apk3.1910.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Alpinepostgresql15apk3.2010.2-r0Not reportedALPINE-CVE-2018-1053Not reported
Ubuntupostgresql-9.3deb14.049.3.21-0ubuntu0.14.04Not reportedUBUNTU-CVE-2018-1053Not reported
Ubuntupostgresql-9.5deb16.049.5.11-0ubuntu0.16.04Not reportedUBUNTU-CVE-2018-1053Not reported
Ubuntupostgresql-9.3deb14.049.3.21-0ubuntu0.14.04Not reportedUSN-3564-1Not reported
Ubuntupostgresql-9.5deb16.049.5.11-0ubuntu0.16.04Not reportedUSN-3564-1Not reported
Debianpostgresql-9.1deb79.1.24lts2-0+deb7u2Not reportedDLA-1271-1Not reported
Susepostgresql94rpmlinux enterprise desktop 12 sp29.4.16-21.16.1Not reportedSUSE-SU-2018:0675-1Not reported
Susepostgresql94rpmlinux enterprise server for raspberry pi 12 sp29.4.16-21.16.1Not reportedSUSE-SU-2018:0675-1Not reported
Susepostgresql94-libsrpmlinux enterprise software development kit 12 sp29.4.16-21.16.1Not reportedSUSE-SU-2018:0675-1Not reported
Susepostgresql94rpmlinux enterprise server 12 sp29.4.16-21.16.1Not reportedSUSE-SU-2018:0675-1Not reported
Susepostgresql94rpmlinux enterprise server for sap applications 12 sp29.4.16-21.16.1Not reportedSUSE-SU-2018:0675-1Not reported
Susepostgresql96rpmlinux enterprise desktop 12 sp29.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql96-libsrpmlinux enterprise desktop 12 sp29.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql96rpmlinux enterprise desktop 12 sp39.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql96-libsrpmlinux enterprise desktop 12 sp39.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql96rpmlinux enterprise server for raspberry pi 12 sp29.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql96-libsrpmlinux enterprise server for raspberry pi 12 sp29.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql96-libsrpmlinux enterprise software development kit 12 sp29.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql96-libsrpmlinux enterprise software development kit 12 sp39.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql96rpmlinux enterprise server 12 sp29.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql96-libsrpmlinux enterprise server 12 sp29.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql96rpmlinux enterprise server for sap applications 12 sp29.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql96-libsrpmlinux enterprise server for sap applications 12 sp29.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql96rpmlinux enterprise server 12 sp39.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql96-libsrpmlinux enterprise server 12 sp39.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql96rpmlinux enterprise server for sap applications 12 sp39.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql96-libsrpmlinux enterprise server for sap applications 12 sp39.6.7-3.13.1Not reportedSUSE-SU-2018:0507-1Not reported
Susepostgresql94-libsrpmlinux enterprise software development kit 11 sp49.4.16-0.23.13.2Not reportedSUSE-SU-2018:0506-1Not reported
Susepostgresql94rpmlinux enterprise server 11 sp49.4.16-0.23.13.2Not reportedSUSE-SU-2018:0506-1Not reported
Susepostgresql94-libsrpmlinux enterprise server 11 sp49.4.16-0.23.13.2Not reportedSUSE-SU-2018:0506-1Not reported
Susepostgresql94rpmlinux enterprise server for sap applications 11 sp49.4.16-0.23.13.2Not reportedSUSE-SU-2018:0506-1Not reported
Susepostgresql94-libsrpmlinux enterprise server for sap applications 11 sp49.4.16-0.23.13.2Not reportedSUSE-SU-2018:0506-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References