Memory leak in PostgreSQL - CVE-2021-3677

Vulnerability identifier: #VU59043

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3677

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform DoS attack or gain access to sensitive information.

The vulnerability exists due memory leak during parallel sort operations. A remote user can force the application to leak memory and perform denial of service attack or read arbitrary memory parts on the system.

PostgreSQL
Gentoo Linux
SUSE CaaS Platform
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Module for Legacy Software
Ubuntu
openEuler
Red Hat Software Collections
Red Hat Virtualization
Red Hat Virtualization Host
rhvm-appliance (Red Hat package)
rh-postgresql12-postgresql (Red Hat package)
rh-postgresql13-postgresql (Red Hat package)
SUSE Linux Enterprise Module for Packagehub Subpackages
postgres-decoderbufs
pgaudit
pg_repack
postgresql-10 (Ubuntu package)
libpq-debugsource
libpq
libpq-debuginfo
libpq-devel
postgresql-12 (Ubuntu package)
postgresql12-pltcl-debuginfo
postgresql12-debugsource
postgresql12-devel
postgresql12-devel-debuginfo
postgresql12-server-devel
postgresql12-server-devel-debuginfo
postgresql12
postgresql12-contrib
postgresql12-contrib-debuginfo
postgresql12-debuginfo
postgresql12-pltcl
postgresql12-server
postgresql12-server-debuginfo
postgresql12-docs
postgresql12-plpython-debuginfo
postgresql12-plpython
postgresql12-plperl-debuginfo
postgresql12-plperl
postgresql-upgrade-devel
postgresql-test-rpm-macros
postgresql-upgrade
postgresql-test
postgresql-static
postgresql-server-devel
postgresql-server
postgresql-plpython3
postgresql-plperl
postgresql-docs
postgresql-contrib
postgresql-pltcl
postgresql
libpq5
libecpg6-debuginfo
libpq5-debuginfo
libecpg6
libpq5-32bit
libpq5-32bit-debuginfo
postgresql-13 (Ubuntu package)
libpq5-debuginfo-32bit
postgresql13
postgresql13-server-devel-debuginfo
postgresql13-server-devel
postgresql13-devel-debuginfo
postgresql13-devel
postgresql13-debugsource
postgresql13-docs
postgresql13-server-debuginfo
postgresql13-server
postgresql13-pltcl-debuginfo
postgresql13-pltcl
postgresql13-plpython-debuginfo
postgresql13-plperl
postgresql13-plpython
postgresql13-plperl-debuginfo
postgresql13-contrib
postgresql13-contrib-debuginfo
postgresql13-debuginfo
postgresql13-test
postgresql-13-test-rpm-macros
postgresql-13-test
postgresql-13-static
postgresql-13-server-devel
postgresql-13-server
postgresql-13-private-libs
postgresql-13-private-devel
postgresql-13-pltcl
postgresql-13-plpython3
postgresql-13-plperl
postgresql-13-llvmjit
postgresql-13-docs
postgresql-13-debugsource
postgresql-13-debuginfo
postgresql-13-contrib
postgresql-13
IBM Qradar SIEM
IBM Spectrum Protect Plus
IBM Security Guardium

Install updates from vendor's website.

PostgreSQL - addressed in versions 11.13, 12.8, 13.4
rhvm-appliance (Red Hat package) - update to 4.5-20220603.1.el8ev
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 12, 7.4.3 Fix Pack 6, 7.5.0 Update Pack 2
IBM Spectrum Protect Plus - update to 10.1.12.4
rh-postgresql12-postgresql (Red Hat package) - update to 12.9-1.el7
rh-postgresql13-postgresql (Red Hat package) - update to 13.5-1.el7
postgres-decoderbufs - update to 0.10.0-2
pgaudit - addressed in versions 1.4.0-5, 1.5.0-1
pg_repack - update to 1.4.6-3
postgresql-10 (Ubuntu package) - update to 10.18-0ubuntu0.18.04.1
libpq-debugsource - update to 11.16-1
libpq - update to 11.16-1
libpq-debuginfo - update to 11.16-1
libpq-devel - update to 11.16-1
postgresql-12 (Ubuntu package) - update to 12.8-0ubuntu0.20.04.1
postgresql12-pltcl-debuginfo - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-debugsource - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-devel - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-devel-debuginfo - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-server-devel - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-server-devel-debuginfo - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12 - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-contrib - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-contrib-debuginfo - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-debuginfo - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-pltcl - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-server - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-server-debuginfo - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-docs - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-plpython-debuginfo - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-plpython - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-plperl-debuginfo - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql12-plperl - addressed in versions 12.8-3.18.2, 12.8-8.23.2, 12.12-150100.3.33.1
postgresql-upgrade-devel - addressed in versions 12.9-1.0.1, 13.5-1.0.1
postgresql-test-rpm-macros - addressed in versions 12.9-1.0.1, 13.5-1.0.1
postgresql-upgrade - addressed in versions 12.9-1.0.1, 13.5-1.0.1
postgresql-test - addressed in versions 12.9-1.0.1, 13.5-1.0.1
postgresql-static - addressed in versions 12.9-1.0.1, 13.5-1.0.1
postgresql-server-devel - addressed in versions 12.9-1.0.1, 13.5-1.0.1
postgresql-server - addressed in versions 12.9-1.0.1, 13.5-1.0.1
postgresql-plpython3 - addressed in versions 12.9-1.0.1, 13.5-1.0.1
postgresql-plperl - addressed in versions 12.9-1.0.1, 13.5-1.0.1
postgresql-docs - addressed in versions 12.9-1.0.1, 13.5-1.0.1
postgresql-contrib - addressed in versions 12.9-1.0.1, 13.5-1.0.1
postgresql-pltcl - addressed in versions 12.9-1.0.1, 13.5-1.0.1
postgresql - addressed in versions 12.9-1.0.1, 13.5-1.0.1
libpq5 - addressed in versions 12.12-150100.3.33.1, 13.4-3.12.2, 13.4-5.16.2
libecpg6-debuginfo - addressed in versions 12.12-150100.3.33.1, 13.4-3.12.2, 13.4-5.16.2
libpq5-debuginfo - addressed in versions 12.12-150100.3.33.1, 13.4-3.12.2, 13.4-5.16.2
libecpg6 - addressed in versions 12.12-150100.3.33.1, 13.4-3.12.2, 13.4-5.16.2
libpq5-32bit - addressed in versions 12.12-150100.3.33.1, 13.4-3.12.2, 13.4-5.16.2
libpq5-32bit-debuginfo - addressed in versions 12.12-150100.3.33.1, 13.4-5.16.2
postgresql-13 (Ubuntu package) - update to 13.4-0ubuntu0.21.04.1
libpq5-debuginfo-32bit - update to 13.4-3.12.2
postgresql13 - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-server-devel-debuginfo - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-server-devel - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-devel-debuginfo - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-devel - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-debugsource - addressed in versions 13.4-3.12.2, 13.4-5.16.1, 13.4-5.16.2
postgresql13-docs - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-server-debuginfo - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-server - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-pltcl-debuginfo - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-pltcl - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-plpython-debuginfo - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-plperl - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-plpython - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-plperl-debuginfo - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-contrib - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-contrib-debuginfo - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-debuginfo - addressed in versions 13.4-3.12.2, 13.4-5.16.2
postgresql13-test - update to 13.4-5.16.2
postgresql-13-test-rpm-macros - update to 13.20-1
postgresql-13-test - update to 13.20-1
postgresql-13-static - update to 13.20-1
postgresql-13-server-devel - update to 13.20-1
postgresql-13-server - update to 13.20-1
postgresql-13-private-libs - update to 13.20-1
postgresql-13-private-devel - update to 13.20-1
postgresql-13-pltcl - update to 13.20-1
postgresql-13-plpython3 - update to 13.20-1
postgresql-13-plperl - update to 13.20-1
postgresql-13-llvmjit - update to 13.20-1
postgresql-13-docs - update to 13.20-1
postgresql-13-debugsource - update to 13.20-1
postgresql-13-debuginfo - update to 13.20-1
postgresql-13-contrib - update to 13.20-1
postgresql-13 - update to 13.20-1

• https://bugzilla.redhat.com/show_bug.cgi?id=2001857
• https://www.postgresql.org/docs/release/13.4/

• Memory leak in PostgreSQL
• Red Hat Software Collections update for rh-postgresql12-postgresql
• Red Hat Software Collections update for rh-postgresql13-postgresql
• Red Hat Enterprise Linux 8 update for the postgresql:12 module
• Red Hat Enterprise Linux 8 update for the postgresql:13 module
• Multiple vulnerabilities in IBM Security Guardium
• Red Hat Virtualization update for postgresql
• SUSE update for postgresql12
• SUSE update for postgresql13
• SUSE update for postgresql13
• SUSE update for postgresql12
• Ubuntu update for postgresql-10
• Multiple vulnerabilities in IBM QRadar SIEM
• SUSE update for postgresql12
• Gentoo update for PostgreSQL
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• openEuler 22.03 LTS update for libpq
• Anolis OS update for postgresql:13 module
• Anolis OS update for postgresql:12 module
• openEuler 20.03 LTS SP4 update for postgresql-13