Vulnerability identifier: #VU53232

Vulnerability risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-32028

CWE-ID:

Exploitation vector: Network

Exploit availability:

Vulnerable software:
PostgreSQL
Server applications / Database software

Vendor: PostgreSQL Global Development Group

Description
The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due memory leak within the INSERT ... ON CONFLICT ... DO UPDATE command implementation. A remote authenticated database user can execute the affected command to read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and complete this attack at will.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

PostgreSQL: 13.0 - 13.2, 12 - 12.6, 11.0 - 11.11, 10.0 - 10.16, 9.6.0 - 9.6.21

---

Fixed software versions

CPE

• cpe:2.3:a:postgresql_global_development_group:postgresql:13.2:*:*:*:*:*:*:*

External links
http://www.postgresql.org/about/news/postgresql-133-127-1112-1017-and-9622-released-2210/

---

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?