CVE-2021-3677
Summary
| CVE | CVE-2021-3677 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-03-02 23:15:00 UTC |
|---|
| Updated | 2023-01-31 17:29:00 UTC |
|---|
| Description | A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| 2001857 – (CVE-2021-3677) CVE-2021-3677 postgresql: memory disclosure in certain queries |
MISC |
bugzilla.redhat.com |
|
| PostgreSQL: CVE-2021-3677: Memory disclosure in certain queries |
MISC |
www.postgresql.org |
|
| PostgreSQL: Multiple Vulnerabilities (GLSA 202211-04) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| CVE-2021-3677 Postgresql Vulnerability in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159576 Oracle Enterprise Linux Security Update for postgresql:12 (ELSA-2021-5235)
- 159577 Oracle Enterprise Linux Security Update for postgresql:13 (ELSA-2021-5236)
- 179602 Debian Security Update for postgresql-13postgresql-11 (CVE-2021-3677)
- 198458 Ubuntu Security Notification for PostgreSQL vulnerabilities (USN-5038-1)
- 239969 Red Hat Update for rh-postgresql13-postgresql (RHSA-2021:5179)
- 239972 Red Hat Update for rh-postgresql12-postgresql (RHSA-2021:5197)
- 239975 Red Hat Update for postgresql:13 (RHSA-2021:5236)
- 239976 Red Hat Update for postgresql:12 (RHSA-2021:5235)
- 375772 PostgreSQL Have Multiple Vulnerabilities
- 500543 Alpine Linux Security Update for postgresql
- 501471 Alpine Linux Security Update for postgresql
- 501994 Alpine Linux Security Update for postgresql13
- 502011 Alpine Linux Security Update for postgresql14
- 502163 Alpine Linux Security Update for postgresql12
- 502777 Alpine Linux Security Update for postgresql15
- 504310 Alpine Linux Security Update for postgresql14
- 690063 Free Berkeley Software Distribution (FreeBSD) Security Update for postgresql server (b471130b-fb86-11eb-87db-6cc21735f730)
- 710683 Gentoo Linux PostgreSQL Multiple Vulnerabilities (GLSA 202211-04)
- 751140 SUSE Enterprise Linux Security Update for postgresql13 (SUSE-SU-2021:3120-1)
- 751141 SUSE Enterprise Linux Security Update for postgresql12 (SUSE-SU-2021:3119-1)
- 751184 OpenSUSE Security Update for postgresql13 (openSUSE-SU-2021:3255-1)
- 751185 OpenSUSE Security Update for postgresql12 (openSUSE-SU-2021:3256-1)
- 752529 SUSE Enterprise Linux Security Update for postgresql12 (SUSE-SU-2022:2958-1)
- 900735 Common Base Linux Mariner (CBL-Mariner) Security Update for postgresql (8884)
- 901185 Common Base Linux Mariner (CBL-Mariner) Security Update for postgresql (8902-1)
- 902692 Common Base Linux Mariner (CBL-Mariner) Security Update for postgresql (8884-1)
- 940094 AlmaLinux Security Update for postgresql:12 (ALSA-2021:5235)
- 940417 AlmaLinux Security Update for postgresql:13 (ALSA-2021:5236)
- 960321 Rocky Linux Security Update for postgresql:13 (RLSA-2021:5236)
- 960337 Rocky Linux Security Update for postgresql:12 (RLSA-2021:5235)
