A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pgauditUpgrade pg_repackUpgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql-upgrade-devel | May 4, 2022 | Mar 2, 2022 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresqlUpgrade postgresql12Upgrade postgresql14Upgrade postgresql13 | Aug 22, 2024 | Mar 2, 2022 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-debuginfoUpgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-private-libsUpgrade postgresql-testUpgrade postgresql-llvmjitUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plpython3Upgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgresql-upgradeUpgrade postgresql-plpython2Upgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-private-devel | Aug 29, 2024 | Mar 2, 2022 |
| Centos_linux | — | Upgrade postgresql-contrib-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plperlUpgrade postgresql-server-devel-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-docs-debuginfoUpgrade postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-plperl-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-staticUpgrade postgresql-server-develUpgrade postgresql-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade postgresql-plpython3Upgrade postgresql-serverUpgrade pg_repack-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade pgaudit-debuginfoUpgrade pg_repackUpgrade postgresql-server-debuginfoUpgrade postgresql-upgradeUpgrade pg_repack-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresqlUpgrade postgres-decoderbufsUpgrade postgresql-test | Dec 22, 2021 | Dec 21, 2021 |
| Debian | — | Upgrade postgresql-13 | Jul 30, 2024 | Mar 2, 2022 |
| Freebsd | — | Upgrade postgresql11-serverUpgrade postgresql13-serverUpgrade postgresql12-server | Nov 4, 2022 | Aug 12, 2021 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Nov 23, 2022 | Mar 2, 2022 |
| Oracle_linux | — | Upgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-plperlUpgrade pg_repackUpgrade postgresqlUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade pgauditUpgrade postgresql-upgrade-develUpgrade postgresql-docsUpgrade postgres-decoderbufsUpgrade postgresql-staticUpgrade postgresql-pltclUpgrade postgresql-contrib | Dec 23, 2021 | Aug 12, 2021 |
| Postgres | — | Upgrade to PostgreSQL version 13.4 | Aug 13, 2021 | Aug 13, 2021 |
| Redhat_linux | — | Upgrade postgresql-upgrade-develUpgrade postgresql-plperl-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-test-rpm-macrosUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-pltclUpgrade postgresql-contrib-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-server-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresqlUpgrade postgresql-docs-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-server-develUpgrade pgauditUpgrade postgresql-plpython3Upgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade pgaudit-debuginfoUpgrade postgresql-testUpgrade postgres-decoderbufs-debuginfoUpgrade pg_repack-debuginfoUpgrade pg_repack | Dec 22, 2021 | Dec 21, 2021 |
| Rocky_linux | — | Upgrade pgaudit-debugsourceUpgrade postgresql-test-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-docs-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-server-develUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-pltclUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgres-decoderbufsUpgrade pg_repackUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade pgauditUpgrade postgresql-docsUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-testUpgrade postgresql-server-debuginfoUpgrade postgresqlUpgrade postgresql-staticUpgrade pg_repack-debugsource | Mar 12, 2024 | Mar 2, 2022 |
| Suse | — | Upgrade postgresql12-develUpgrade postgresql12-docsUpgrade postgresql13-testUpgrade postgresql13-develUpgrade postgresql13-serverUpgrade libecpg6-32bitUpgrade postgresql13-pltclUpgrade postgresql13-llvmjit-develUpgrade postgresql13-plpythonUpgrade postgresql12-server-develUpgrade postgresql13-server-develUpgrade postgresql13-docsUpgrade postgresql12-contribUpgrade postgresql13-plperlUpgrade postgresql12-testUpgrade postgresql12-plpythonUpgrade postgresql13-contribUpgrade postgresql12-llvmjitUpgrade postgresql13Upgrade postgresql12-pltclUpgrade libecpg6Upgrade libpq5Upgrade postgresql12-plperlUpgrade postgresql12-serverUpgrade postgresql13-llvmjitUpgrade libpq5-32bitUpgrade postgresql12 | Sep 17, 2021 | Aug 12, 2021 |
| Ubuntu | — | Upgrade postgresql-12Upgrade postgresql-13 | Aug 14, 2021 | Aug 12, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub