This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-33204 →

UBUNTU-CVE-2021-33204

In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achieved via SECURITY DEFINER func...

Original description

The description as published by the source.

In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achieved via SECURITY DEFINER functions because an explicit search_path is not set.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:16.04:LTS pg-partman

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:18.04:LTS pg-partman

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:20.04:LTS pg-partman

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

report ubuntu.com
report github.com
report github.com
report cve.org