Description
A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.
References (3)
Core 3
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1956883
Vendor Advisory x_refsource_misc
https://www.postgresql.org/support/security/CVE-2021-32029/
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20211112-0003/
Scores
CVSS v3
6.5
EPSS
0.0018
EPSS Percentile
38.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-125
CWE-200
Status
published
Products (2)
postgresql/postgresql
11.0 - 11.12
redhat/jboss_enterprise_application_platform
7.0.0
Published
Oct 08, 2021
Tracked Since
Feb 18, 2026