Memory Disclosure Vulnerability in PostgreSQL: CVE-2021-32028
Summary
ALPINE-CVE-2021-32028: A flaw was found in postgresql. Affects postgresql versions < 11.12-r0. Fixed in 11.12-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database system that uses and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types. The vulnerability CVE-2021-32028 affects multiple versions of PostgreSQL, allowing authenticated users to exploit a flaw in the INSERT ... ON CONFLICT ... DO UPDATE command, potentially leading to unauthorized access to sensitive server memory.
Vulnerability Detail
A flaw was found in PostgreSQL where an authenticated database user could exploit the INSERT ... ON CONFLICT ... DO UPDATE command on a specially crafted table. This could allow the user to read arbitrary bytes of server memory, posing a significant risk to data confidentiality. The vulnerability originates from improper handling of memory during the execution of the command, which could lead to unintended data exposure.
How To Fix
Minimum fixed version
11.12-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, limit the permissions of authenticated users to prevent them from executing the vulnerable command on sensitive tables until the package can be updated.
Conclusion
CVE-2021-32028 is a significant vulnerability in PostgreSQL that can lead to unauthorized access to sensitive data. It is crucial for users to update their PostgreSQL installations to the latest patched versions to mitigate this risk. Additionally, implementing temporary workarounds can help protect against potential exploitation until updates are applied.
See every vulnerability recorded for postgresql →
FAQ
CVE-2021-32028 is a vulnerability in PostgreSQL that allows authenticated users to read arbitrary bytes of server memory through a specific SQL command.
Affected versions include PostgreSQL in Alpine v3.10, v3.11, v3.12, v3.13, v3.14, v3.15, v3.16, v3.17, v3.18, v3.19, and v3.20.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2021-32028 is 6.5, indicating a medium severity level.
If immediate updating is not possible, consider limiting user permissions and monitoring database activity for any suspicious actions.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
