PT-2021-4285 · Unknown · Pg Partman

Tapioaiven · Published 2021-05-19 · Updated 2021-09-07 · CVE-2021-33204

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 4.5.1

Description The issue allows for arbitrary code execution via SECURITY DEFINER functions due to the lack of an explicit search path setting. This can potentially enable a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For versions prior to 4.5.1, update to version 4.5.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of SECURITY DEFINER functions until the update is applied.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2021-04893

CVE-2021-33204

Affected Products

Pg Partman

References · 11

• https://github.com/pgpartman/pg_partman/commit/0b6565ad378c358f8a6cd1d48ddc482eb7f854d3 · Patch
• https://github.com/pgpartman/pg_partman/compare/v4.5.0...v4.5.1 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-33204 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-33204 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-33204 · Security Note
• https://bdu.fstec.ru/vul/2021-04893 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33204 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-33204 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-33204 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-33204 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210625-0006 · Note