PT-2021-1982 · Unknown+10 · Postgresql+9
Heikki Linnakangas
·
Published
2021-02-10
·
Updated
2026-01-30
·
CVE-2021-3393
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
postgresql versions prior to 13.2
postgresql versions prior to 12.6
postgresql versions prior to 11.11
Description
An information leak was discovered in postgresql. A user with UPDATE permission but not SELECT permission to a particular column could craft queries that might disclose values from that column in error messages under certain circumstances. This could allow an attacker to obtain information stored in a column they are allowed to write but not read.
Recommendations
For versions prior to 13.2, update to version 13.2 or later to resolve the issue.
For versions prior to 12.6, update to version 12.6 or later to resolve the issue.
For versions prior to 11.11, update to version 11.11 or later to resolve the issue.
Fix
Information Disclosure
Generation of Error Message Containing Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Postgresql
Red Hat
Rocky Linux
Suse
Ubuntu