CVE catalog
CVE-2019-3466
postgresql-common: CVE-2019-3466
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.50% · Oct 25, 2026
The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | postgresql-common | sid | 293 | fixed |
| Debian | postgresql-common | forky | 293 | fixed |
| Debian | postgresql-common | trixie | 278 | fixed |
| Debian | postgresql-common | bookworm | 248+deb12u1 | fixed |
| Ubuntu | postgresql-common | 16.04 | 169git1 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 170 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 171 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 172 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 172ubuntu1 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 173 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 173ubuntu0.1 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 173ubuntu0.2 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 173ubuntu0.3 | fixed |
| Ubuntu | postgresql-common | 18.04 | 184ubuntu1 | vulnerable |
| Ubuntu | postgresql-common | 18.04 | 188ubuntu1 | vulnerable |
| Ubuntu | postgresql-common | 18.04 | 189 | vulnerable |
| Ubuntu | postgresql-common | 18.04 | 190 | vulnerable |
| Ubuntu | postgresql-common | 18.04 | 190ubuntu0.1 | fixed |
| Ubuntu | postgresql-common | pro | 148 | vulnerable |
| Ubuntu | postgresql-common | pro | 150 | vulnerable |
| Ubuntu | postgresql-common | pro | 151 | vulnerable |
| Ubuntu | postgresql-common | pro | 152 | vulnerable |
| Ubuntu | postgresql-common | pro | 153 | vulnerable |
| Ubuntu | postgresql-common | pro | 153bzr1 | vulnerable |
| Ubuntu | postgresql-common | pro | 154 | vulnerable |
| Ubuntu | postgresql-common | pro | 154ubuntu1 | vulnerable |
| Ubuntu | postgresql-common | pro | 154ubuntu1.1 | vulnerable |
| Ubuntu | postgresql-common | pro | 154ubuntu1.1+esm1 | fixed |
| Ubuntu | postgresql-common | pro | 148 | vulnerable |
| Ubuntu | postgresql-common | pro | 150 | vulnerable |
| Ubuntu | postgresql-common | pro | 151 | vulnerable |
| Ubuntu | postgresql-common | pro | 152 | vulnerable |
| Ubuntu | postgresql-common | pro | 153 | vulnerable |
| Ubuntu | postgresql-common | pro | 153bzr1 | vulnerable |
| Ubuntu | postgresql-common | pro | 154 | vulnerable |
| Ubuntu | postgresql-common | pro | 154ubuntu1 | vulnerable |
| Ubuntu | postgresql-common | pro | 154ubuntu1.1 | vulnerable |
| Ubuntu | postgresql-common | pro | 154ubuntu1.1+esm1 | fixed |
| Ubuntu | postgresql-common | 16.04 | 169git1 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 170 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 171 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 172 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 172ubuntu1 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 173 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 173ubuntu0.1 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 173ubuntu0.2 | vulnerable |
| Ubuntu | postgresql-common | 16.04 | 173ubuntu0.3 | fixed |
| Ubuntu | postgresql-common | 18.04 | 184ubuntu1 | vulnerable |
| Ubuntu | postgresql-common | 18.04 | 188ubuntu1 | vulnerable |
| Ubuntu | postgresql-common | 18.04 | 189 | vulnerable |
| Ubuntu | postgresql-common | 18.04 | 190 | vulnerable |
| Ubuntu | postgresql-common | 18.04 | 190ubuntu0.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | postgresql-common | source | sid | 210 | not yet assigned | Not reported | Not reported |
| Debian | postgresql-common | source | forky | 210 | not yet assigned | Not reported | Not reported |
| Debian | postgresql-common | source | trixie | 210 | not yet assigned | Not reported | Not reported |
| Debian | postgresql-common | source | bookworm | 210 | not yet assigned | Not reported | Not reported |
| Ubuntu | postgresql-common | deb | 16.04 | 173ubuntu0.3 | Not reported | USN-4194-1 | Not reported |
| Ubuntu | postgresql-common | deb | 18.04 | 190ubuntu0.1 | Not reported | USN-4194-1 | Not reported |
| Ubuntu | postgresql-common | deb | pro | 154ubuntu1.1+esm1 | Not reported | USN-4194-2 | Not reported |
| Ubuntu | postgresql-common | deb | pro | 154ubuntu1.1+esm1 | Not reported | UBUNTU-CVE-2019-3466 | Not reported |
| Ubuntu | postgresql-common | deb | 16.04 | 173ubuntu0.3 | Not reported | UBUNTU-CVE-2019-3466 | Not reported |
| Ubuntu | postgresql-common | deb | 18.04 | 190ubuntu0.1 | Not reported | UBUNTU-CVE-2019-3466 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [postgresql]Fixed
Source package: [postgresql-common]
Details (2)
15+248+deb12u1· all · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
15+248+deb12u1· all · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
- [postgresql-all]Fixed
Source package: [postgresql-common]
Details (2)
248+deb12u1· all · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
248+deb12u1· all · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
- [postgresql-client]Fixed
Source package: [postgresql-common]
Details (2)
15+248+deb12u1· all · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
15+248+deb12u1· all · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
- [postgresql-client-common]Fixed
Source package: [postgresql-common]
Details (2)
248+deb12u1· all · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
248+deb12u1· all · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
- [postgresql-common]Fixed
Details (2)
248+deb12u1· all · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
248+deb12u1· all · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
- [postgresql-contrib]Fixed
Source package: [postgresql-common]
Details (2)
15+248+deb12u1· all · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
15+248+deb12u1· all · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
- [postgresql-doc]Fixed
Source package: [postgresql-common]
Details (2)
15+248+deb12u1· all · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
15+248+deb12u1· all · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
- [postgresql-server-dev-all]Fixed
Source package: [postgresql-common]
Details (2)
248+deb12u1· amd64 · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
248+deb12u1· arm64 · bookwormFixed · Fixed:
210dsa · postgresql-common · debian · bookworm; dsa · postgresql-common · debian · 12
[Debian 13 (Trixie)]
- [postgresql]Fixed
Source package: [postgresql-common]
Details (2)
17+278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
17+278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
- [postgresql-all]Fixed
Source package: [postgresql-common]
Details (2)
278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
- [postgresql-client]Fixed
Source package: [postgresql-common]
Details (2)
17+278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
17+278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
- [postgresql-client-common]Fixed
Source package: [postgresql-common]
Details (2)
278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
- [postgresql-common]Fixed
Details (2)
278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
- [postgresql-common-dev]Fixed
Source package: [postgresql-common]
Details (2)
278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
- [postgresql-doc]Fixed
Source package: [postgresql-common]
Details (2)
17+278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
17+278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
- [postgresql-server-dev-all]Fixed
Source package: [postgresql-common]
Details (2)
278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
278· all · trixieFixed · Fixed:
210dsa · postgresql-common · debian · 13
Observed:
References
- [https://osv.dev/vulnerability/ALPINE-CVE-2019-3466]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2019-3466]
- [https://osv.dev/vulnerability/DLA-1994-1]
- [https://osv.dev/vulnerability/DSA-4568-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2019-3466]
- [https://osv.dev/vulnerability/USN-4194-1]
- [https://osv.dev/vulnerability/USN-4194-2]
- [https://security-tracker.debian.org/tracker/CVE-2019-3466]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]