CVE-2017-12172

Vulnerability in Red Hat, Inc. Postgresql

CVSS score

6.7

EPSS probability

%0.6

Risk score

0.0

Published

9 y ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Patch status has not yet been verified

Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2017-12172 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2017-12172 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

ID	VENDOR	PRODUCT	ACTION
1	Red Hat, Inc.	postgresql	View
2	postgresql	postgresql	View
3	postgresql	postgresql	View
4	postgresql	postgresql	View
5	postgresql	postgresql	View
6	postgresql	postgresql	View
7	postgresql	postgresql	View
8	postgresql	postgresql	View
9	postgresql	postgresql	View
10	postgresql	postgresql	View
11	postgresql	postgresql	View
12	postgresql	postgresql	View
13	postgresql	postgresql	View
14	postgresql	postgresql	View
15	postgresql	postgresql	View
16	postgresql	postgresql	View
17	postgresql	postgresql	View
18	postgresql	postgresql	View
19	postgresql	postgresql	View
20	postgresql	postgresql	View
21	postgresql	postgresql	View
22	postgresql	postgresql	View
23	postgresql	postgresql	View
24	postgresql	postgresql	View
25	postgresql	postgresql	View
26	postgresql	postgresql	View
27	postgresql	postgresql	View
28	postgresql	postgresql	View
29	postgresql	postgresql	View
30	postgresql	postgresql	View
31	postgresql	postgresql	View
32	postgresql	postgresql	View
33	postgresql	postgresql	View
34	postgresql	postgresql	View
35	postgresql	postgresql	View
36	postgresql	postgresql	View
37	postgresql	postgresql	View
38	postgresql	postgresql	View
39	postgresql	postgresql	View
40	postgresql	postgresql	View
41	postgresql	postgresql	View
42	postgresql	postgresql	View
43	postgresql	postgresql	View
44	postgresql	postgresql	View
45	postgresql	postgresql	View
46	postgresql	postgresql	View
47	postgresql	postgresql	View
48	postgresql	postgresql	View
49	postgresql	postgresql	View
50	postgresql	postgresql	View
51	postgresql	postgresql	View
52	postgresql	postgresql	View
53	postgresql	postgresql	View
54	postgresql	postgresql	View
55	postgresql	postgresql	View
56	postgresql	postgresql	View
57	postgresql	postgresql	View
58	postgresql	postgresql	View
59	postgresql	postgresql	View
60	postgresql	postgresql	View
61	postgresql	postgresql	View
62	postgresql	postgresql	View
63	postgresql	postgresql	View
64	postgresql	postgresql	View
65	postgresql	postgresql	View
66	postgresql	postgresql	View
67	postgresql	postgresql	View
68	postgresql	postgresql	View
69	postgresql	postgresql	View
70	postgresql	postgresql	View
71	postgresql	postgresql	View
72	postgresql	postgresql	View
73	postgresql	postgresql	View
74	postgresql	postgresql	View
75	postgresql	postgresql	View
76	postgresql	postgresql	View
77	postgresql	postgresql	View

Total affected vendors: 2|Products: 77

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCORE	VERSION	SEVERITY	VECTOR	SOURCE
7.2	CVSS V2	—	AV:L/AC:L/Au:N/C:C/I:C/A:C	NVD
6.7	CVSS V30	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	NVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch status unknown

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Confirm the affected product and version against the source evidence above.

Restrict access to internet-facing services and apply network segmentation.

Until a patch is confirmed, follow the vendor advisory; do not read an unknown status as “no patch”.

Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2017-12172 is associated with the following CWEs:

CWE-59: Common Weakness Enumeration Entry CWE-59

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2017-12172 weaknesses.

CAPEC-66: SQL Injection CAPEC-126: Path Traversal CAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureYerel erişim

PermissionsHigh

UserGerekmiyor

Official Sources and Advisories

RHSA-2017:3402vendor-advisory 101949vendor-advisory RHSA-2017:3403vendor-advisory RHSA-2017:3405vendor-advisory https://www.postgresql.org/support/security/vendor-advisory 1039752vendor-advisory https://www.postgresql.org/about/news/1801/vendor-advisory RHSA-2017:3404vendor-advisory

CVSS Vector Radar Chart

6.7 / 10

Vulnerability Scoring Details

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack VectorLocal

Attack ComplexityLow

Privileges RequiredHigh privileges

User InteractionNone required

Confidentiality (Gizlilik)Low

Integrity (Bütünlük)None

Availability (Erişilebilirlik)High

Yama durumu bilinmiyor

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Follow the vendor

Red Hat, Inc.

postgresql

Weakness Type (CWE & CAPEC)

CWE-59

Similar Vulnerabilities

9.8

CVE-2017-12149 Actively exploitedDeserialization of untrusted data in Red Hat, Inc. Jbossas

VendorRed Hat, Inc.Productjbossas+4 etkilenen

Workaround Public Exploits:1EPSS %919 y ago

7.5

CVE-2026-42198pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

Vendorpgjdbc Productpgjdbc+2 etkilenen

Patch status unknownEPSS %35 mo ago

4.2

CVE-2018-1115Incorrect permission assignment in Unspecified Postgresql

Vendorunspecified Productpostgresql+4 etkilenen

Patch verifiedEPSS %48 y ago

7.5

CVE-2023-39417Postgresql: extension script @substitutions@ within quoting allow sql injection

VendorRed Hat ProductRed Hat Advanced Cluster Security 4.2+13 etkilenen

Patch status unknownEPSS %23 y ago

8.8

CVE-2026-2005Buffer overflow in Postgresql

Vendorpostgresql Productpostgresql

Patch status unknown Public Exploits:4EPSS %18 mo ago

8.8

CVE-2026-2004Vulnerability in Postgresql