Moderate: postgresql:12 security update
Summary
ALSA-2021:5235: Moderate: postgresql:12 security update. Affects pg_repack across 3 version ranges.
< 1.4.6-3.module_el8.5.0+2606+4554acc4
< 1.4.6-3.module_el8.6.0+2758+4f4474df
< 1.4.6-3.module_el8.6.0+2760+1746ec94
Fixed in 1.4.6-3.module_el8.5.0+2606+4554acc4, 1.4.6-3.module_el8.6.0+2758+4f4474df or 1.4.6-3.module_el8.6.0+2760+1746ec94, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS). It is widely used for storing and managing large amounts of structured and unstructured data. PostgreSQL provides a rich set of features and capabilities, including support for complex queries, transactions, and data integrity. It is known for its reliability, scalability, and extensibility. However, like any software, PostgreSQL is not immune to security vulnerabilities.
Vulnerability Detail
The vulnerability in PostgreSQL version 12.9 involves two security issues:
-
CVE-2021-3677: This vulnerability allows for memory disclosure in certain queries. An attacker could exploit this vulnerability to gain unauthorized access to sensitive information stored in the database.
-
CVE-2021-23214: This vulnerability allows server processes to receive unencrypted bytes from a man-in-the-middle. An attacker could intercept and modify the data exchanged between the server and clients, potentially leading to data tampering or leakage.
These vulnerabilities pose a moderate risk and could potentially be exploited by attackers to compromise the confidentiality and integrity of the database.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update pg_repack-
< 1.4.6-3.module_el8.5.0+2606+4554acc41.4.6-3.module_el8.5.0+2606+4554acc4 -
< 1.4.6-3.module_el8.6.0+2758+4f4474df1.4.6-3.module_el8.6.0+2758+4f4474df -
< 1.4.6-3.module_el8.6.0+2760+1746ec941.4.6-3.module_el8.6.0+2760+1746ec94
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
PostgreSQL version 12.9 includes security updates to address vulnerabilities that could compromise the confidentiality and integrity of the database. It is recommended to update PostgreSQL to the latest version to ensure the security and stability of your database. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for pg_repack →
FAQ
PostgreSQL is an advanced object-relational database management system (DBMS) known for its reliability, scalability, and extensibility.
CVE-2021-3677 is a vulnerability in PostgreSQL that allows for memory disclosure in certain queries, potentially exposing sensitive information.
CVE-2021-23214 is a vulnerability in PostgreSQL that allows server processes to receive unencrypted bytes from a man-in-the-middle, potentially leading to data tampering or leakage.
These vulnerabilities could be exploited by attackers to gain unauthorized access to sensitive information stored in the database or tamper with the data exchanged between the server and clients.
To fix these vulnerabilities, update PostgreSQL to version 12.9 or later.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
