UBUNTU-CVE-2021-3677

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2021-3677
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-3677.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-3677
Related
Published
2021-08-12T00:00:00Z
Modified
2021-08-12T00:00:00Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include maxworkerprocesses=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.

References

Affected packages

Ubuntu:20.04:LTS / postgresql-12

Package

Name
postgresql-12
Purl
pkg:deb/ubuntu/postgresql-12@12.8-0ubuntu0.20.04.1?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
12.8-0ubuntu0.20.04.1

Affected versions

12.*

12.0-1
12.1-1
12.1-2build1
12.2-1
12.2-1ubuntu2
12.2-4
12.4-0ubuntu0.20.04.1
12.5-0ubuntu0.20.04.1
12.6-0ubuntu0.20.04.1
12.7-0ubuntu0.20.04.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "postgresql-12-dbgsym": "12.8-0ubuntu0.20.04.1",
            "libecpg6": "12.8-0ubuntu0.20.04.1",
            "postgresql-doc-12": "12.8-0ubuntu0.20.04.1",
            "libecpg-dev": "12.8-0ubuntu0.20.04.1",
            "postgresql-client-12-dbgsym": "12.8-0ubuntu0.20.04.1",
            "postgresql-client-12": "12.8-0ubuntu0.20.04.1",
            "libpq5": "12.8-0ubuntu0.20.04.1",
            "libpq5-dbgsym": "12.8-0ubuntu0.20.04.1",
            "postgresql-server-dev-12": "12.8-0ubuntu0.20.04.1",
            "postgresql-pltcl-12-dbgsym": "12.8-0ubuntu0.20.04.1",
            "libpq-dev": "12.8-0ubuntu0.20.04.1",
            "libpgtypes3": "12.8-0ubuntu0.20.04.1",
            "libecpg-dev-dbgsym": "12.8-0ubuntu0.20.04.1",
            "postgresql-plpython3-12": "12.8-0ubuntu0.20.04.1",
            "postgresql-plpython3-12-dbgsym": "12.8-0ubuntu0.20.04.1",
            "postgresql-pltcl-12": "12.8-0ubuntu0.20.04.1",
            "libpgtypes3-dbgsym": "12.8-0ubuntu0.20.04.1",
            "libecpg-compat3": "12.8-0ubuntu0.20.04.1",
            "postgresql-plperl-12": "12.8-0ubuntu0.20.04.1",
            "postgresql-12": "12.8-0ubuntu0.20.04.1",
            "postgresql-plperl-12-dbgsym": "12.8-0ubuntu0.20.04.1",
            "libecpg-compat3-dbgsym": "12.8-0ubuntu0.20.04.1",
            "libecpg6-dbgsym": "12.8-0ubuntu0.20.04.1"
        }
    ]
}