CVE-2021-3677
A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated dat...
Original description
The description as published by the source.
A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.
Affected packages
Bitnami
postgresql
[{"type":"SEMVER","events":[{"introduced":"11.0.0"},{"fixed":"11.13.0"},{"introduced":"12.0.0"},{"fixed":"12.8.0"},{"introduced":"13.0.0"},{"fixed":"13.4.0"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2021-3677 postgresql Fixed in: 12.8-r0
- Debian DEBIAN-CVE-2021-3677 postgresql-13 Fixed in: 13.4-0+deb11u1
References
- advisory bugzilla.redhat.com
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory postgresql.org
- web nvd.nist.gov