CVE-2021-3393
EUVD-2021-2672201.04.2021, 14:15
An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| postgresql | postgresql | 𝑥 < 11.11 |
| postgresql | postgresql | 12.0 ≤ 𝑥 < 12.6 |
| postgresql | postgresql | 13.0 ≤ 𝑥 < 13.2 |
| redhat | software_collections | - |
| redhat | enterprise_linux | 8.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| postgresql-10 |
| ||||||||||
| postgresql-12 |
| ||||||||||
| postgresql-13 |
| ||||||||||
| postgresql-9.1 |
| ||||||||||
| postgresql-9.3 |
| ||||||||||
| postgresql-9.5 |
|
Common Weakness Enumeration
References