A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade postgresql-upgrade-develUpgrade pg_repackUpgrade postgres-decoderbufsUpgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql-contribUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-plpython3Upgrade postgresql-pltclUpgrade postgresql-server-develUpgrade postgresql-test-rpm-macros | May 4, 2022 | Mar 2, 2022 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql14Upgrade postgresql12Upgrade postgresqlUpgrade postgresql13 | Aug 22, 2024 | Mar 2, 2022 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-private-libsUpgrade postgresql-debuginfoUpgrade postgresql-server-develUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-plpython2Upgrade postgresql-private-develUpgrade postgresql-pltclUpgrade postgresql-upgrade-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plpython3Upgrade postgresql-llvmjitUpgrade postgresql-upgrade | Aug 29, 2024 | Mar 2, 2022 |
| Centos_linux | — | Upgrade postgresql-testUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3Upgrade pgauditUpgrade pg_repack-debuginfoUpgrade pg_repackUpgrade postgresql-staticUpgrade postgres-decoderbufsUpgrade postgresqlUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-serverUpgrade postgresql-server-debuginfoUpgrade postgresql-server-develUpgrade pg_repack-debugsourceUpgrade postgresql-plperlUpgrade postgresql-upgrade-develUpgrade postgresql-plperl-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-pltclUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade pgaudit-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-contrib | Dec 22, 2021 | Dec 21, 2021 |
| Debian | — | Upgrade postgresql-13 | Jul 30, 2024 | Mar 2, 2022 |
| Freebsd | — | Upgrade postgresql12-serverUpgrade postgresql13-serverUpgrade postgresql11-server | Nov 4, 2022 | Aug 12, 2021 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Nov 23, 2022 | Mar 2, 2022 |
| Oracle_linux | — | Upgrade pgauditUpgrade postgresql-pltclUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-upgradeUpgrade pg_repackUpgrade postgresql-plpython3Upgrade postgresql-plperlUpgrade postgresql | Dec 23, 2021 | Aug 12, 2021 |
| Postgres | — | Upgrade to PostgreSQL version 13.4 | Aug 13, 2021 | Aug 13, 2021 |
| Redhat_linux | — | Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-pltclUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-contribUpgrade postgresql-test-debuginfoUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgres-decoderbufsUpgrade pgaudit-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade postgresql-pltcl-debuginfoUpgrade postgresql-docs-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-debugsourceUpgrade pgauditUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade pg_repackUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pg_repack-debuginfo | Dec 22, 2021 | Dec 21, 2021 |
| Rocky_linux | — | Upgrade postgresql-docs-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgradeUpgrade postgres-decoderbufs-debugsourceUpgrade pg_repack-debuginfoUpgrade postgresql-contribUpgrade postgresql-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3Upgrade pgaudit-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plperlUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgaudit-debuginfo | Mar 12, 2024 | Mar 2, 2022 |
| Suse | — | Upgrade postgresql13-server-develUpgrade libecpg6Upgrade postgresql13-pltclUpgrade postgresql12-llvmjitUpgrade postgresql13Upgrade postgresql12-server-develUpgrade postgresql12-plpythonUpgrade postgresql13-plperlUpgrade postgresql12-develUpgrade postgresql13-docsUpgrade libecpg6-32bitUpgrade postgresql13-serverUpgrade postgresql12-docsUpgrade postgresql13-develUpgrade postgresql12-pltclUpgrade postgresql13-llvmjit-develUpgrade postgresql13-testUpgrade postgresql13-contribUpgrade postgresql12-contribUpgrade postgresql12-testUpgrade postgresql13-plpythonUpgrade postgresql12-plperlUpgrade libpq5-32bitUpgrade libpq5Upgrade postgresql12Upgrade postgresql12-serverUpgrade postgresql13-llvmjit | Sep 17, 2021 | Aug 12, 2021 |
| Ubuntu | — | Upgrade postgresql-12Upgrade postgresql-13 | Aug 14, 2021 | Aug 12, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub