VulnerableCode Package Details - pkg:deb/ubuntu/postgresql-10@10.17-0ubuntu0.18.04.1

Search for packages

Vulnerability	Summary	Fixed by
VCID-6cjv-xp17-aaah Aliases: CVE-2021-3449 GHSA-83mx-573x-5rw9 VC-OPENSSL-20210325-CVE-2021-3449	An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).	10.18-0ubuntu0.18.04.1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-w1rw-arxv-aaar Aliases: CVE-2021-23222	A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.	10.19-0ubuntu0.18.04.1 Affected by 0 other vulnerabilities.
VCID-zh5y-x6pg-aaar Aliases: CVE-2021-23214	When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.	10.19-0ubuntu0.18.04.1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-6cjv-xp17-aaah
Aliases:
CVE-2021-3449
GHSA-83mx-573x-5rw9
VC-OPENSSL-20210325-CVE-2021-3449

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

10.18-0ubuntu0.18.04.1
Affected by 2 other vulnerabilities.

VCID-w1rw-arxv-aaar
Aliases:
CVE-2021-23222

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

10.19-0ubuntu0.18.04.1
Affected by 0 other vulnerabilities.

VCID-zh5y-x6pg-aaar
Aliases:
CVE-2021-23214

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

10.19-0ubuntu0.18.04.1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-abn1-q8d7-aaac	A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.	CVE-2021-32028
VCID-u1bv-tfg8-aaaf	A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	CVE-2021-32027

Vulnerability

Summary

Aliases

VCID-abn1-q8d7-aaac

A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.

CVE-2021-32028

VCID-u1bv-tfg8-aaaf

A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVE-2021-32027

Next non-vulnerable version	10.19-0ubuntu0.18.04.1
Latest non-vulnerable version	10.19-0ubuntu0.18.04.1
Risk	4.0