Summary
Tom Lane discovered that PostgreSQL incorrect handled certain array
subscripting calculations. An authenticated attacker could possibly use
this issue to overwrite server memory and escalate privileges.
(CVE-2021-32027)
Andres Freund discovered that PostgreSQL incorrect handled certain
INSERT ... ON CONFLICT ... DO UPDATE commands. A remote attacker could
possibly use this issue to read server memory and obtain sensitive
information. (CVE-2021-32028)
Tom Lane discovered that PostgreSQL incorrect handled certain UPDATE ...
RETURNING commands. A remote attacker could possibly use this issue to read
server memory and obtain sensitive information. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-32029)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | postgresql-10 | 10.17-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | postgresql-12 | 12.7-0ubuntu0.20.04.1 |
Vulnerabilities 3
-
Unscored —
A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. Whil…
-
Unscored —
A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an au…
-
Unscored —
A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated data…