Information Exposure Affecting postgresql-12 package, versions <12.6-0ubuntu0.20.04.1


Severity

Recommended
0.0
medium
0
10

Based on Ubuntu security rating.

Threat Intelligence

EPSS
0.06% (30th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU2004-POSTGRESQL12-1073621
  • published12 Feb 2021
  • disclosed1 Apr 2021

Introduced: 12 Feb 2021

CVE-2021-3393  (opens in a new tab)
CWE-209  (opens in a new tab)

How to fix?

Upgrade Ubuntu:20.04 postgresql-12 to version 12.6-0ubuntu0.20.04.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream postgresql-12 package and not the postgresql-12 package as distributed by Ubuntu. See How to fix? for Ubuntu:20.04 relevant fixed versions and status.

An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.

CVSS Scores

version 3.1