CVE-2017-14798
local privilege escalation in SUSE postgresql init script
A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
local privilege escalation in SUSE postgresql init script
A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.
- Record
CVE-2017-14798- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-61
- Updated
- 2026-11-02
EUVDEUVD-2017-6287
A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.
- Record
EUVD-2017-6287- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-934j-74pq-c42g
A race condition in the postgresql init script could be used by attackers able to access the...
A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.
- Record
GHSA-934j-74pq-c42g- CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
NVD
A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.
- Record
CVE-2017-14798- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-61, CWE-362
- Updated
- 2026-11-02
OSVBELL-CVE-2017-14798
CVE-2017-14798 does not affect BellSoft software
- Record
BELL-CVE-2017-14798- CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11183-1 No score
postgresql-13-2.7 on GA media
These are all security issues fixed in the postgresql-13-2.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11183-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:3107-1 No score
Security update for postgresql-init
This update for postgresql-init fixes the following issues:
- CVE-2017-14798: A race condition in the init script could be used by attackers able to access the postgresql account to escalate their privileges to root (bsc#1062722)
- Record
SUSE-SU-2017:3107-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
postgresql-initSUSE:Linux Enterprise Server 11 SP4 |
before 9.4-0.5.3.1 | 9.4-0.5.3.1 |
postgresql-initSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 9.4-0.5.3.1 | 9.4-0.5.3.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | PostgreSQL 9.4-0.5.3 - Privilege Escalation | 2018-08-13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-14798 is a high vulnerability (CVSS 7.3) in Postgresql, published November 27, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 62nd percentile. Fixed in postgresql-init 9.4-0.5.3.1.