Information Leak Vulnerability in PostgreSQL - CVE-2021-3393
Summary
ALPINE-CVE-2021-3393: An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. Affects postgresql versions < 11.11-r0. Fixed in 11.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database system known for its robustness, extensibility, and standards compliance. It supports a wide variety of data types and offers advanced features such as transactions, subselects, triggers, views, and stored procedures. However, certain versions of PostgreSQL are vulnerable to an information leak that could allow unauthorized access to sensitive data.
Vulnerability Detail
An information leak was discovered in PostgreSQL versions prior to 13.2, 12.6, and 11.11. This vulnerability arises when a user has UPDATE permission but lacks SELECT permission on a specific column. Under certain conditions, crafted queries could inadvertently disclose values from that column in error messages. An attacker could exploit this flaw to gain access to information stored in a column they are permitted to write to but not read from, potentially leading to unauthorized data exposure.
How To Fix
Minimum fixed version
11.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting UPDATE permissions for users who do not have SELECT permissions on sensitive columns. This can be done by adjusting the role privileges in PostgreSQL using the following SQL command:
REVOKE UPDATE ON table_name FROM user_name;
Conclusion
CVE-2021-3393 represents a significant information leak vulnerability in PostgreSQL that could lead to unauthorized data exposure. It is crucial for users to update their PostgreSQL installations to the latest patched versions to mitigate this risk. Additionally, implementing proper permission controls can help prevent exploitation of this vulnerability.
See every vulnerability recorded for postgresql →
FAQ
CVE-2021-3393 is a vulnerability in PostgreSQL that allows information leakage from columns where a user has UPDATE permission but not SELECT permission.
Versions prior to 13.2, 12.6, and 11.11 are affected by this vulnerability.
An attacker could exploit this vulnerability to access sensitive information from columns they should not be able to read.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2021-3393 is 4.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
