A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufsUpgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-upgrade-develUpgrade pgauditUpgrade pg_repackUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltcl | May 4, 2022 | Mar 2, 2022 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql12Upgrade postgresql14Upgrade postgresql15Upgrade postgresql13 | Aug 22, 2024 | Mar 2, 2022 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade postgresql-private-libsUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-plpython2Upgrade postgresql-upgrade-develUpgrade postgresql-llvmjitUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-private-devel | Aug 29, 2024 | Mar 2, 2022 |
| Centos_linux | — | Upgrade postgresql-upgradeUpgrade postgresql-serverUpgrade postgresql-testUpgrade pg_repack-debugsourceUpgrade pg_repack-debuginfoUpgrade postgresqlUpgrade pgaudit-debuginfoUpgrade pgauditUpgrade postgresql-staticUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-server-develUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-server-debuginfoUpgrade pg_repackUpgrade postgresql-plpython3Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-pltcl | Dec 22, 2021 | Dec 21, 2021 |
| Debian | — | Upgrade postgresql-13 | Jul 30, 2024 | Mar 2, 2022 |
| Freebsd | — | Upgrade postgresql11-serverUpgrade postgresql13-serverUpgrade postgresql12-server | Nov 4, 2022 | Aug 12, 2021 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Nov 23, 2022 | Mar 2, 2022 |
| Oracle_linux | — | Upgrade postgresql-serverUpgrade postgresql-server-develUpgrade pg_repackUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade pgauditUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade postgresql-upgrade-develUpgrade postgresql-pltclUpgrade postgresql-staticUpgrade postgresql-contrib | Dec 23, 2021 | Aug 12, 2021 |
| Postgres | — | Upgrade to PostgreSQL version 13.4 | Aug 13, 2021 | Aug 13, 2021 |
| Redhat_linux | — | Upgrade postgresql-upgradeUpgrade postgresql-debugsourceUpgrade pg_repackUpgrade pgauditUpgrade postgresql-plpython3Upgrade postgresql-server-develUpgrade pg_repack-debuginfoUpgrade postgresql-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-docs-debuginfoUpgrade pg_repack-debugsourceUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-upgrade-develUpgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade postgresql-test-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-docsUpgrade postgres-decoderbufsUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-pltclUpgrade pgaudit-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contrib | Dec 22, 2021 | Dec 21, 2021 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade pgaudit-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-develUpgrade postgresql-upgrade-develUpgrade postgresql-upgradeUpgrade postgresql-test-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-debugsourceUpgrade pg_repack-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plpython3Upgrade postgresql-docs-debuginfoUpgrade postgresql-contribUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-server-debuginfoUpgrade pg_repackUpgrade postgres-decoderbufs-debuginfoUpgrade pg_repack-debugsourceUpgrade postgres-decoderbufsUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plperlUpgrade postgresql-debuginfoUpgrade pgauditUpgrade postgresql-serverUpgrade postgresql-plperl-debuginfo | Mar 12, 2024 | Mar 2, 2022 |
| Suse | — | Upgrade libecpg6Upgrade postgresql13-serverUpgrade postgresql13-develUpgrade postgresql12-plpythonUpgrade postgresql12-docsUpgrade postgresql12-llvmjitUpgrade postgresql13-testUpgrade postgresql13-plpythonUpgrade postgresql13Upgrade libecpg6-32bitUpgrade postgresql13-server-develUpgrade postgresql13-plperlUpgrade postgresql13-llvmjit-develUpgrade postgresql12-pltclUpgrade postgresql13-contribUpgrade postgresql12-server-develUpgrade postgresql13-docsUpgrade postgresql12-develUpgrade postgresql12-contribUpgrade postgresql12-testUpgrade postgresql13-pltclUpgrade postgresql13-llvmjitUpgrade libpq5-32bitUpgrade postgresql12-serverUpgrade postgresql12-plperlUpgrade postgresql12Upgrade libpq5 | Sep 17, 2021 | Aug 12, 2021 |
| Ubuntu | — | Upgrade postgresql-13Upgrade postgresql-12 | Aug 14, 2021 | Aug 12, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub