Arch Linux alert ASA-202106-15 (postgresql)
| From: | Jonas Witschel via arch-security <arch-security@lists.archlinux.org> | |
| To: | arch-security@lists.archlinux.org | |
| Subject: | [ASA-202106-15] postgresql: multiple issues | |
| Date: | Thu, 03 Jun 2021 10:44:27 +0200 | |
| Message-ID: | <20210603084427.4ln4hjztnjbgap6l@archlinux.org> | |
| Cc: | Jonas Witschel <diabonas@archlinux.org> |
Arch Linux Security Advisory ASA-202106-15 ========================================== Severity: Medium Date : 2021-06-01 CVE-ID : CVE-2021-32027 CVE-2021-32028 CVE-2021-32029 Package : postgresql Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1956 Summary ======= The package postgresql before version 13.3-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 13.3-1. # pacman -Syu "postgresql>=13.3-1" The problems have been fixed upstream in version 13.3. Workaround ========== None. Description =========== - CVE-2021-32027 (arbitrary code execution) A security issue was found in PostgreSQL before version 13.3. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. - CVE-2021-32028 (information disclosure) A security issue was found in PostgreSQL before version 13.3. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and complete this attack at will. A user lacking the CREATE and TEMPORARY privileges on all databases and the CREATE privilege on all schemas cannot use this attack at will. - CVE-2021-32029 (information disclosure) A security issue was found in PostgreSQL before version 13.3. Using an UPDATE ... RETURNING on a purpose-crafted partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and complete this attack at will. A user lacking the CREATE and TEMPORARY privileges on all databases and the CREATE privilege on all schemas typically cannot use this attack at will. Impact ====== An authenticated remote attacker could read the database server memory or execute arbitrary code on the server. References ========== https://www.postgresql.org/support/security/CVE-2021-32027/ https://git.postgresql.org/gitweb/?p=postgresql.git;a=com... https://www.postgresql.org/support/security/CVE-2021-32028/ https://git.postgresql.org/gitweb/?p=postgresql.git;a=com... https://www.postgresql.org/support/security/CVE-2021-32029/ https://git.postgresql.org/gitweb/?p=postgresql.git;a=com... https://security.archlinux.org/CVE-2021-32027 https://security.archlinux.org/CVE-2021-32028 https://security.archlinux.org/CVE-2021-32029