Summary
It was discovered that the PostgresQL planner could create incorrect plans
in certain circumstances. A remote attacker could use this issue to cause
PostgreSQL to crash, resulting in a denial of service, or possibly obtain
sensitive information from memory. This issue only affected Ubuntu 20.04
LTS and Ubuntu 21.04. (CVE-2021-3677)
It was discovered that PostgreSQL incorrectly handled certain SSL
renegotiation ClientHello messages from clients. A remote attacker could
possibly use this issue to cause PostgreSQL to crash, resulting in a denial
of service. (CVE-2021-3449)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | postgresql-10 | 10.18-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | postgresql-12 | 12.8-0ubuntu0.20.04.1 |
Vulnerabilities 2
-
Medium 5.9
NULL pointer deref in signature_algorithms processing
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a si…
-
Unscored —
A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default confi…