A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-staticUpgrade pgauditUpgrade postgresql-testUpgrade pg_repackUpgrade postgresql-upgrade-develUpgrade postgresql-docsUpgrade postgres-decoderbufsUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-server-devel | May 4, 2022 | Mar 2, 2022 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql15Upgrade postgresql13Upgrade postgresql12Upgrade postgresql14 | Aug 22, 2024 | Mar 2, 2022 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-private-libsUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade postgresql-plperlUpgrade postgresql-server-develUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-llvmjitUpgrade postgresql-staticUpgrade postgresql-upgradeUpgrade postgresql-upgrade-develUpgrade postgresql-plpython2Upgrade postgresql-private-develUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade postgresql-contrib | Aug 29, 2024 | Mar 2, 2022 |
| Centos_linux | — | Upgrade postgresql-plperl-debuginfoUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-contrib-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade pgaudit-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-plperlUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-pltclUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-develUpgrade postgresql-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-upgradeUpgrade postgresql-staticUpgrade pg_repack-debugsourceUpgrade pg_repackUpgrade postgresql-server-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresqlUpgrade postgresql-upgrade-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgres-decoderbufsUpgrade pgauditUpgrade pg_repack-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plpython3-debuginfo | Dec 22, 2021 | Dec 21, 2021 |
| Debian | — | Upgrade postgresql-13 | Jul 30, 2024 | Mar 2, 2022 |
| Freebsd | — | Upgrade postgresql11-serverUpgrade postgresql13-serverUpgrade postgresql12-server | Nov 4, 2022 | Aug 12, 2021 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Nov 23, 2022 | Mar 2, 2022 |
| Oracle_linux | — | Upgrade postgresql-upgrade-develUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade pg_repackUpgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-plpython3Upgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade postgresql-test | Dec 23, 2021 | Aug 12, 2021 |
| Postgres | — | Upgrade to PostgreSQL version 13.4 | Aug 13, 2021 | Aug 13, 2021 |
| Redhat_linux | — | Upgrade pg_repack-debuginfoUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-server-develUpgrade pgaudit-debuginfoUpgrade pgauditUpgrade postgresql-upgradeUpgrade postgresql-debuginfoUpgrade postgresql-testUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-server-debuginfoUpgrade pg_repackUpgrade postgresql-plpython3Upgrade postgres-decoderbufs-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-serverUpgrade postgresql-docs-debuginfoUpgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade pgaudit-debugsourceUpgrade postgresql-docsUpgrade postgres-decoderbufsUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-plperl-debuginfo | Dec 22, 2021 | Dec 21, 2021 |
| Rocky_linux | — | Upgrade postgresql-server-debuginfoUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-upgrade-debuginfoUpgrade pgauditUpgrade postgresql-docsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-serverUpgrade postgres-decoderbufsUpgrade postgresql-debuginfoUpgrade postgresql-plperlUpgrade pg_repackUpgrade pg_repack-debugsourceUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-staticUpgrade pg_repack-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plpython3Upgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgresql-test-debuginfoUpgrade pgaudit-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresql-plpython3-debuginfo | Mar 12, 2024 | Mar 2, 2022 |
| Suse | — | Upgrade postgresql12-serverUpgrade postgresql13-llvmjitUpgrade postgresql12Upgrade libpq5-32bitUpgrade postgresql12-plperlUpgrade libpq5Upgrade postgresql12-testUpgrade postgresql13-testUpgrade postgresql13-serverUpgrade postgresql12-pltclUpgrade postgresql13-llvmjit-develUpgrade postgresql12-develUpgrade postgresql12-server-develUpgrade libecpg6Upgrade postgresql13-docsUpgrade postgresql13-contribUpgrade postgresql13-plperlUpgrade postgresql12-llvmjitUpgrade postgresql12-contribUpgrade postgresql13-server-develUpgrade postgresql13-plpythonUpgrade postgresql12-plpythonUpgrade postgresql12-docsUpgrade libecpg6-32bitUpgrade postgresql13-develUpgrade postgresql13-pltclUpgrade postgresql13 | Sep 17, 2021 | Aug 12, 2021 |
| Ubuntu | — | Upgrade postgresql-12Upgrade postgresql-13 | Aug 14, 2021 | Aug 12, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub