Moderate: postgresql:13 security update
Summary
ALSA-2021:5236: Moderate: postgresql:13 security update. Affects pg_repack across 3 version ranges.
< 1.4.6-3.module_el8.5.0+2607+8c0fd184
< 1.4.6-3.module_el8.6.0+2758+4f4474df
< 1.4.6-3.module_el8.6.0+2760+1746ec94
Fixed in 1.4.6-3.module_el8.5.0+2607+8c0fd184, 1.4.6-3.module_el8.6.0+2758+4f4474df or 1.4.6-3.module_el8.6.0+2760+1746ec94, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS). It is widely used for storing and managing structured data. PostgreSQL provides a rich set of features and capabilities, making it a popular choice for many applications and organizations. However, like any software, PostgreSQL is not immune to vulnerabilities and security issues.
Vulnerability Detail
The vulnerability (CVE-2021-3677) in PostgreSQL allows for memory disclosure in certain queries. This means that an attacker could potentially access sensitive information from the database's memory by crafting specific queries. Additionally, another vulnerability (CVE-2021-23214) allows for server processes to receive unencrypted bytes from a man-in-the-middle. This could lead to unauthorized access or data interception. These vulnerabilities pose a moderate risk and should be addressed promptly to ensure the security of the PostgreSQL installation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update pg_repack-
< 1.4.6-3.module_el8.5.0+2607+8c0fd1841.4.6-3.module_el8.5.0+2607+8c0fd184 -
< 1.4.6-3.module_el8.6.0+2758+4f4474df1.4.6-3.module_el8.6.0+2758+4f4474df -
< 1.4.6-3.module_el8.6.0+2760+1746ec941.4.6-3.module_el8.6.0+2760+1746ec94
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible to mitigate the risk.
Conclusion
In conclusion, these vulnerabilities in PostgreSQL pose a moderate risk and should be addressed promptly. It is recommended to update the PostgreSQL package to the latest version (13.5) to mitigate the risk of memory disclosure and man-in-the-middle attacks. For further support and assistance with vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for pg_repack →
FAQ
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, scalability, and extensibility. It is widely used in various applications and industries.
The memory disclosure vulnerability (CVE-2021-3677) could allow an attacker to access sensitive information from the database's memory. The man-in-the-middle vulnerability (CVE-2021-23214) could lead to unauthorized access or data interception.
To update PostgreSQL, you can download the latest version from the official PostgreSQL website or use the package manager of your operating system. Follow the recommended update process and ensure that all dependencies and configurations are properly updated as well.
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and acknowledgments, on the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
