Important: postgresql:12 security update
Summary
ALSA-2021:2372: Important: postgresql:12 security update. Affects postgres-decoderbufs across 2 version ranges.
< 0.10.0-2.module_el8.6.0+2758+4f4474df
< 0.10.0-2.module_el8.6.0+2760+1746ec94
Fixed in 0.10.0-2.module_el8.6.0+2758+4f4474df or 0.10.0-2.module_el8.6.0+2760+1746ec94, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS). It is widely used for storing and managing large amounts of structured data. PostgreSQL provides a rich set of features and is known for its reliability, scalability, and extensibility. However, like any software, it is susceptible to vulnerabilities that can compromise its security.
Vulnerability Detail
The latest security update for PostgreSQL addresses multiple vulnerabilities:
-
CVE-2021-32027: This vulnerability involves a buffer overrun caused by an integer overflow in array subscripting calculations. An attacker could exploit this issue to execute arbitrary code or cause a denial of service.
-
CVE-2021-32028: This vulnerability allows for memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE statements. An attacker could use this flaw to obtain sensitive information from the database.
-
CVE-2021-32029: This vulnerability leads to memory disclosure in partitioned-table UPDATE ... RETURNING statements. An attacker could exploit this issue to access confidential data.
-
CVE-2021-3393: This vulnerability results in partition constraint violation errors leaking values of denied columns. An attacker could use this information to gain unauthorized access to sensitive data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update postgres-decoderbufs-
< 0.10.0-2.module_el8.6.0+2758+4f4474df0.10.0-2.module_el8.6.0+2758+4f4474df -
< 0.10.0-2.module_el8.6.0+2760+1746ec940.10.0-2.module_el8.6.0+2760+1746ec94
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
PostgreSQL users should update to version 12.7 to address the identified vulnerabilities. Keeping software up to date is crucial for maintaining the security and integrity of your database. If you need further assistance or have any questions, please contact DevNack.com.
See every vulnerability recorded for postgres-decoderbufs →
FAQ
PostgreSQL is an advanced object-relational database management system (DBMS) known for its reliability, scalability, and extensibility. It is widely used for storing and managing large amounts of structured data.
The update addresses the following vulnerabilities:
- CVE-2021-32027: Buffer overrun from integer overflow in array subscripting calculations
- CVE-2021-32028: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE
- CVE-2021-32029: Memory disclosure in partitioned-table UPDATE ... RETURNING
- CVE-2021-3393: Partition constraint violation errors leak values of denied columns
These vulnerabilities could allow an attacker to execute arbitrary code, cause a denial of service, obtain sensitive information, or gain unauthorized access to data.
To fix these vulnerabilities, update PostgreSQL to the latest version (12.7).
You can obtain the updated package from the official PostgreSQL website or through your distribution's package manager.
Related vulnerabilities
Recent vulnerabilities recorded for postgres-decoderbufs.
