{"id":"CVE-2019-3466","aliases":["ALPINE-CVE-2019-3466","BELL-CVE-2019-3466","DEBIAN-CVE-2019-3466","DLA-1994-1","DSA-4568-1","EUVD-2019-13104","GHSA-rhrq-jx2f-79g7","UBUNTU-CVE-2019-3466","USN-4194-1","USN-4194-2"],"status":"published","title":"The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges...","description":"The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00499,"percentile":0.43046,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2019-11-14T00:00:00Z","modified":"2026-09-21T07:01:40Z","fixes":[{"ecosystem":"Debian:12","package":"postgresql-common","fixed_in":["210"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"postgresql-common","fixed_in":["210"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"postgresql-common","fixed_in":["210"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"postgresql-common","fixed_in":["165+deb8u4"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"postgresql-common","fixed_in":["181+deb9u3"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"postgresql-common","fixed_in":["200+deb10u3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"postgresql-common","fixed_in":["154ubuntu1.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"postgresql-common","fixed_in":["173ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"postgresql-common","fixed_in":["190ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"210"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"210"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"210"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"165+deb8u4"}]}],"versions":["165","165+deb8u1","165+deb8u1~bpo7+1","165+deb8u2","165+deb8u2~bpo7+1","165+deb8u3"]},{"source":"osv","ecosystem":"Debian:9","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"181+deb9u3"}]}],"versions":["181","181+deb9u1","181+deb9u1~bpo8+1","181+deb9u2"]},{"source":"osv","ecosystem":"Debian:10","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"200+deb10u3"}]}],"versions":["200+deb10u1","200+deb10u2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"154ubuntu1.1+esm1"}]}],"versions":["148","150","151","152","153","153bzr1","154","154ubuntu1","154ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"173ubuntu0.3"}]}],"versions":["169git1","170","171","172","172ubuntu1","173","173ubuntu0.1","173ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"190ubuntu0.1"}]}],"versions":["184ubuntu1","188ubuntu1","189","190"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"173ubuntu0.3"}]}],"versions":["169git1","170","171","172","172ubuntu1","173","173ubuntu0.1","173ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"190ubuntu0.1"}]}],"versions":["184ubuntu1","188ubuntu1","189","190"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"154ubuntu1.1+esm1"}]}],"versions":["148","150","151","152","153","153bzr1","154","154ubuntu1","154ubuntu1.1"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"postgresql","product":"postgresql-common"}],"references":[{"url":"https://blog.mirch.io/2019/11/15/cve-2019-3466-debian-ubuntu-pg_ctlcluster-privilege-escalation/","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix"]},{"url":"https://usn.ubuntu.com/4194-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3466"},{"url":"https://github.com/advisories/GHSA-rhrq-jx2f-79g7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-3466","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-3466","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3466","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-3466","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4194-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4194-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3466","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-3466","description":"The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.","status":"published","published":"2019-11-20T17:16:16Z","modified":"2024-08-04T19:12:09.467Z","updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-13104","description":"The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.","status":"published","published":"2019-11-20T17:16:16Z","modified":"2024-08-04T19:12:09Z","updated_at":"2026-11-03T03:06:55.481882Z"}],"ghsa":[{"id":"GHSA-rhrq-jx2f-79g7","title":"The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges...","description":"The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.","status":"published","published":"2022-05-24T17:01:37Z","modified":"2023-01-28T05:07:45Z","updated_at":"2026-11-02T14:44:34.06652Z"}],"nvd":[{"id":"CVE-2019-3466","description":"The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.","status":"published","published":"2019-11-20T18:15:10.977Z","modified":"2026-06-17T02:35:10.283Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:05:37.024431Z"}],"osv":[{"id":"ALPINE-CVE-2019-3466","description":"The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.","status":"withdrawn","published":"2019-11-20T18:15:10.977Z","modified":"2026-07-14T08:03:27.14649517Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-3466","title":"CVE-2019-3466 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:06.266368Z","modified":"2026-01-26T09:49:00.622945Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-3466","description":"The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.","status":"published","published":"2019-11-20T18:15:10.977Z","modified":"2026-03-14T09:38:03.852252Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3466","description":"The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.","status":"published","published":"2019-11-20T18:15:10.977Z","modified":"2026-09-21T07:01:40.170998017Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"UBUNTU-CVE-2019-3466","description":"The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.","status":"published","published":"2019-11-14T00:00:00Z","modified":"2026-02-04T03:43:00.916627Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"DLA-1994-1","title":"postgresql-common - security update","status":"published","published":"2019-11-15T00:00:00Z","modified":"2026-03-09T01:18:55.451968Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4568-1","title":"postgresql-common - security update","status":"published","published":"2019-11-14T00:00:00Z","modified":"2026-03-09T02:11:19.939465Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"USN-4194-1","title":"postgresql-common vulnerability","description":"Rich Mirch discovered that the postgresql-common pg_ctlcluster script\nincorrectly handled directory creation. A local attacker could possibly use\nthis issue to escalate privileges.\n","status":"published","published":"2019-11-14T18:36:40Z","modified":"2026-02-10T04:41:41Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4194-2","title":"postgresql-common vulnerability","description":"USN-4194-1 fixed a vulnerability in postgresql-common. This update provides\nthe corresponding update for Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n Rich Mirch discovered that the postgresql-common pg_ctlcluster script\n incorrectly handled directory creation. A local attacker could possibly use\n this issue to escalate privileges.\n","status":"published","published":"2019-12-03T18:34:11Z","modified":"2026-02-10T04:41:41Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}