Search for packages
| purl | pkg:deb/ubuntu/postgresql-12@12.2-1 |
| Next non-vulnerable version | 12.9-0ubuntu0.20.04.1 |
| Latest non-vulnerable version | 12.9-0ubuntu0.20.04.1 |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-5n1r-psrw-aaac
Aliases: CVE-2021-3393 |
An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read. |
Affected by 7 other vulnerabilities. |
|
VCID-6cjv-xp17-aaah
Aliases: CVE-2021-3449 GHSA-83mx-573x-5rw9 VC-OPENSSL-20210325-CVE-2021-3449 |
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j). |
Affected by 2 other vulnerabilities. |
|
VCID-9hqr-9vgj-aaam
Aliases: CVE-2021-3677 |
A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting. |
Affected by 2 other vulnerabilities. |
|
VCID-abn1-q8d7-aaac
Aliases: CVE-2021-32028 |
A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality. |
Affected by 4 other vulnerabilities. |
|
VCID-bjfv-tdu3-aaaf
Aliases: CVE-2020-25696 |
A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. |
Affected by 8 other vulnerabilities. |
|
VCID-bqpm-hqn6-aaak
Aliases: CVE-2020-14349 |
It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication. |
Affected by 11 other vulnerabilities. |
|
VCID-emb8-3ekz-aaaq
Aliases: CVE-2020-25694 |
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. |
Affected by 8 other vulnerabilities. |
|
VCID-fqn5-6psn-aaac
Aliases: CVE-2020-14350 |
It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23. |
Affected by 11 other vulnerabilities. |
|
VCID-pcnf-hxf7-aaaj
Aliases: CVE-2020-25695 |
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. |
Affected by 8 other vulnerabilities. |
|
VCID-u1bv-tfg8-aaaf
Aliases: CVE-2021-32027 |
A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. |
Affected by 4 other vulnerabilities. |
|
VCID-uz5d-sf31-aaar
Aliases: CVE-2021-32029 |
A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality. |
Affected by 4 other vulnerabilities. |
|
VCID-w1rw-arxv-aaar
Aliases: CVE-2021-23222 |
A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption. |
Affected by 0 other vulnerabilities. |
|
VCID-zh5y-x6pg-aaar
Aliases: CVE-2021-23214 |
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|