A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-staticUpgrade pgauditUpgrade postgresql-docsUpgrade postgresql-upgrade-develUpgrade pg_repackUpgrade postgresql-testUpgrade postgres-decoderbufsUpgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macros | May 4, 2022 | Mar 2, 2022 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql15Upgrade postgresql12Upgrade postgresql14Upgrade postgresql13 | Aug 22, 2024 | Mar 2, 2022 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-private-develUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-develUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-plpython3Upgrade postgresql-plpython2Upgrade postgresql-llvmjitUpgrade postgresql-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-server-devel | Aug 29, 2024 | Mar 2, 2022 |
| Centos_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade postgresql-debugsourceUpgrade postgresql-server-develUpgrade pgaudit-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-staticUpgrade postgresql-serverUpgrade postgresql-upgradeUpgrade pgauditUpgrade postgresqlUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-testUpgrade postgresql-plpython3Upgrade postgres-decoderbufsUpgrade pg_repack-debugsourceUpgrade postgresql-server-debuginfoUpgrade pg_repackUpgrade postgresql-pltclUpgrade postgresql-plperl-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-plperlUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgresql-upgrade-develUpgrade pgaudit-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresql-contribUpgrade postgresql-upgrade-devel-debuginfo | Dec 22, 2021 | Dec 21, 2021 |
| Debian | — | Upgrade postgresql-13 | Jul 30, 2024 | Mar 2, 2022 |
| Freebsd | — | Upgrade postgresql12-serverUpgrade postgresql13-serverUpgrade postgresql11-server | Nov 4, 2022 | Aug 12, 2021 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Nov 23, 2022 | Mar 2, 2022 |
| Oracle_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgresql-pltclUpgrade pgauditUpgrade postgresql-plpython3Upgrade postgresql-plperlUpgrade postgresqlUpgrade pg_repackUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresql-server-develUpgrade postgresql-server | Dec 23, 2021 | Aug 12, 2021 |
| Postgres | — | Upgrade to PostgreSQL version 13.4 | Aug 13, 2021 | Aug 13, 2021 |
| Redhat_linux | — | Upgrade postgres-decoderbufsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-devel-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-staticUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltclUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-docsUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-contribUpgrade postgresql-test-debuginfoUpgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade pgaudit-debuginfoUpgrade pg_repackUpgrade pgauditUpgrade pg_repack-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade pg_repack-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresqlUpgrade postgresql-testUpgrade postgres-decoderbufs-debuginfo | Dec 22, 2021 | Dec 21, 2021 |
| Rocky_linux | — | Upgrade postgresql-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-pltclUpgrade pg_repack-debuginfoUpgrade postgresql-server-develUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresql-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pg_repackUpgrade pg_repack-debugsourceUpgrade postgresql-staticUpgrade postgresql-server-debuginfoUpgrade postgresqlUpgrade pgauditUpgrade postgresql-serverUpgrade postgresql-plperl-debuginfoUpgrade postgresql-plperlUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgres-decoderbufs | Mar 12, 2024 | Mar 2, 2022 |
| Suse | — | Upgrade postgresql13-llvmjitUpgrade libpq5Upgrade postgresql12-serverUpgrade postgresql12-plperlUpgrade postgresql12Upgrade libpq5-32bitUpgrade postgresql13-docsUpgrade postgresql13-pltclUpgrade postgresql12-plpythonUpgrade libecpg6Upgrade postgresql12-pltclUpgrade postgresql12-develUpgrade postgresql12-server-develUpgrade postgresql13-llvmjit-develUpgrade postgresql12-llvmjitUpgrade postgresql13Upgrade postgresql13-develUpgrade libecpg6-32bitUpgrade postgresql13-testUpgrade postgresql13-serverUpgrade postgresql12-docsUpgrade postgresql13-contribUpgrade postgresql12-contribUpgrade postgresql12-testUpgrade postgresql13-server-develUpgrade postgresql13-plpythonUpgrade postgresql13-plperl | Sep 17, 2021 | Aug 12, 2021 |
| Ubuntu | — | Upgrade postgresql-13Upgrade postgresql-12 | Aug 14, 2021 | Aug 12, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub