This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-33204 →

DEBIAN-CVE-2021-33204

In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achieved via SECURITY DEFINER func...

Original description

The description as published by the source.

In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achieved via SECURITY DEFINER functions because an explicit search_path is not set.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 pg-partman

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-1"}]}]

Debian:13 pg-partman

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-1"}]}]

Debian:14 pg-partman

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-1"}]}]

References

advisory security-tracker.debian.org