A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-upgrade-develUpgrade postgresql-docsUpgrade pgauditUpgrade pg_repackUpgrade postgresql-testUpgrade postgres-decoderbufsUpgrade postgresql-staticUpgrade postgresql-plpython3Upgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-upgradeUpgrade postgresql-test-rpm-macros | May 4, 2022 | Mar 2, 2022 |
| Alpine Linux | — | Upgrade postgresql12Upgrade postgresql14Upgrade postgresql13Upgrade postgresql15Upgrade postgresql | Aug 22, 2024 | Mar 2, 2022 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-plpython2Upgrade postgresql-upgrade-develUpgrade postgresql-private-develUpgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plpython3Upgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-llvmjitUpgrade postgresql-debuginfoUpgrade postgresql-server-develUpgrade postgresql-private-libsUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-test | Aug 29, 2024 | Mar 2, 2022 |
| Centos_linux | — | Upgrade postgresql-plpython3Upgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-server-develUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-server-debuginfoUpgrade postgresql-staticUpgrade pg_repackUpgrade pgauditUpgrade pg_repack-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-pltcl-debuginfoUpgrade pg_repack-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-debugsourceUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-plperl-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-plperlUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-test-rpm-macros | Dec 22, 2021 | Dec 21, 2021 |
| Debian | — | Upgrade postgresql-13 | Jul 30, 2024 | Mar 2, 2022 |
| Freebsd | — | Upgrade postgresql12-serverUpgrade postgresql13-serverUpgrade postgresql11-server | Nov 4, 2022 | Aug 12, 2021 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Nov 23, 2022 | Mar 2, 2022 |
| Oracle_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade pgauditUpgrade postgres-decoderbufsUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-plpython3Upgrade pg_repack | Dec 23, 2021 | Aug 12, 2021 |
| Postgres | — | Upgrade to PostgreSQL version 13.4 | Aug 13, 2021 | Aug 13, 2021 |
| Redhat_linux | — | Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-contribUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgres-decoderbufsUpgrade postgresql-test-debuginfoUpgrade postgresqlUpgrade postgresql-server-develUpgrade pg_repack-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-serverUpgrade pg_repackUpgrade postgresql-plpython3Upgrade postgresql-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-docs-debuginfoUpgrade pg_repack-debugsourceUpgrade pgauditUpgrade postgresql-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgres-decoderbufs-debuginfo | Dec 22, 2021 | Dec 21, 2021 |
| Rocky_linux | — | Upgrade postgresqlUpgrade pg_repackUpgrade postgresql-plperlUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-staticUpgrade postgres-decoderbufs-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgresql-plperl-debuginfoUpgrade postgresql-serverUpgrade postgresql-server-debuginfoUpgrade postgresql-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade pg_repack-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plpython3Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-develUpgrade postgresql-upgrade-develUpgrade postgresql-debugsourceUpgrade pgaudit-debugsourceUpgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgresql-test-debuginfo | Mar 12, 2024 | Mar 2, 2022 |
| Suse | — | Upgrade postgresql12-server-develUpgrade postgresql13-docsUpgrade postgresql13-plpythonUpgrade postgresql13-testUpgrade postgresql12-llvmjitUpgrade postgresql12-serverUpgrade postgresql13-llvmjitUpgrade libpq5-32bitUpgrade postgresql12Upgrade libpq5Upgrade postgresql12-plperlUpgrade postgresql13-contribUpgrade postgresql13-serverUpgrade postgresql12-plpythonUpgrade postgresql13-develUpgrade libecpg6Upgrade postgresql12-develUpgrade postgresql12-pltclUpgrade postgresql13-llvmjit-develUpgrade postgresql12-contribUpgrade postgresql12-testUpgrade postgresql13-plperlUpgrade postgresql13-server-devel | Sep 17, 2021 | Aug 12, 2021 |
| Ubuntu | — | Upgrade postgresql-13Upgrade postgresql-12 | Aug 14, 2021 | Aug 12, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub