PT-2021-3135 · Postgresql+9 · Postgresql+9
Tom Lane
·
Published
2021-05-12
·
Updated
2026-04-03
·
CVE-2021-32027
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
postgresql versions prior to 13.3
postgresql versions prior to 12.7
postgresql versions prior to 11.12
postgresql versions prior to 10.17
postgresql versions prior to 9.6.22
Description
A flaw was found in postgresql that allows authenticated database users to write arbitrary bytes to a wide area of server memory due to missing bounds checks while modifying certain SQL array values. This issue poses a threat to data confidentiality and integrity, as well as system availability. The vulnerability can be exploited by a remote attacker using specially crafted SQL queries, potentially allowing the execution of arbitrary code.
Recommendations
For versions prior to 13.3, update to version 13.3 or later.
For versions prior to 12.7, update to version 12.7 or later.
For versions prior to 11.12, update to version 11.12 or later.
For versions prior to 10.17, update to version 10.17 or later.
For versions prior to 9.6.22, update to version 9.6.22 or later.
Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Postgresql
Red Hat
Rocky Linux
Suse
Ubuntu