PostgreSQL SELECT Privilege Vulnerability - CVE-2021-20229
Summary
ALPINE-CVE-2021-20229: A flaw was found in PostgreSQL in versions before 13.2. Affects postgresql versions < 12.6-r0. Fixed in 12.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source relational database management system that uses and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types. However, a vulnerability has been identified in versions prior to 13.2, which allows users with SELECT privileges on one column to exploit the system and access all columns of a table, posing a significant risk to data confidentiality.
Vulnerability Detail
A flaw was found in PostgreSQL versions before 13.2 that allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. This vulnerability can lead to unauthorized data exposure, compromising the confidentiality of sensitive information stored in the database. The issue arises from improper handling of user privileges, allowing for unintended data access.
How To Fix
Minimum fixed version
12.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting SELECT privileges to only the necessary columns for users, thereby minimizing the risk of unauthorized data access until the system can be updated.
Conclusion
In summary, CVE-2021-20229 is a significant vulnerability in PostgreSQL that allows unauthorized access to sensitive data through improper handling of user privileges. It is crucial to update to the latest patched versions to mitigate this risk and ensure the confidentiality of your data.
See every vulnerability recorded for postgresql →
FAQ
CVE-2021-20229 is a vulnerability in PostgreSQL that allows users with SELECT privileges on one column to access all columns of a table.
Versions of PostgreSQL prior to 13.2 are affected by this vulnerability.
The primary risk is unauthorized access to sensitive data, which can compromise confidentiality.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring signup.
The CVSS score for this vulnerability is 4.3, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
