CVE-2021-3393
An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT...
Original description
The description as published by the source.
An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.
Affected packages
Bitnami
postgresql
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"11.11.0"},{"introduced":"12.0.0"},{"fixed":"12.6.0"},{"introduced":"13.0.0"},{"fixed":"13.2.0"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2021-3393 postgresql Fixed in: 11.11-r0
- Debian DEBIAN-CVE-2021-3393 postgresql-13 Fixed in: 13.2-1
References
- advisory bugzilla.redhat.com
- advisory security.gentoo.org
- advisory security.netapp.com
- web nvd.nist.gov