title: local privilege escalation in SUSE postgresql init script
description: A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.
problem types: creation of directory could follow symlinks
affected:
{
product: postgresql-init
vendor: suse
versions:
lessThanOrEqual: 9.4-0.5.3.1, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.0
]
solutions: Update to the update packages.