CVE-2021-32028
11.10.2021, 17:15
A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.Enginsight
| Vendor | Product | Version |
|---|---|---|
| postgresql | postgresql | 9.6.0 ≤ 𝑥 < 9.6.22 |
| postgresql | postgresql | 10.0 ≤ 𝑥 < 10.17 |
| postgresql | postgresql | 11.0 ≤ 𝑥 < 11.12 |
| postgresql | postgresql | 12.0 ≤ 𝑥 < 12.7 |
| postgresql | postgresql | 13.0 ≤ 𝑥 < 13.3 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| postgresql-10 |
| ||||||||||||||||||||||||
| postgresql-12 |
| ||||||||||||||||||||||||
| postgresql-13 |
| ||||||||||||||||||||||||
| postgresql-9.1 |
| ||||||||||||||||||||||||
| postgresql-9.3 |
| ||||||||||||||||||||||||
| postgresql-9.5 |
|
Common Weakness Enumeration
References