ALT-PU-2018-1346-1
Closed vulnerabilities
Published: 2018-04-16
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2017-10140
Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.
Severity: HIGH (7.8)
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References:
- [oss-sec] 20170611 Berkeley DB reads DB_CONFIG from cwd
- [oss-sec] 20170611 Berkeley DB reads DB_CONFIG from cwd
- http://www.postfix.org/announcements/postfix-3.2.2.html
- http://www.postfix.org/announcements/postfix-3.2.2.html
- RHSA-2019:0366
- RHSA-2019:0366
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
Closed bugs
postfix-* update may fail to restart postfix properly
/etc/postfix/aliases перезаписывается без создания бакапа, если удалить "root: name"
Возможно, не работает postconf -a
Unit entered failed state при обновлении
Поменять кодировку README.ALT на utf8
Configuration file /lib/systemd/system/postfix.service is marked executable