CVE-2021-32027: Buffer Overflow
A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
PostgreSQL could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an integer overflow while modifying certain SQL array values. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw in PostgreSQL?
The vulnerability ID for this flaw in PostgreSQL is CVE-2021-32027.
What is the severity level of CVE-2021-32027?
The severity level of CVE-2021-32027 is high, with a CVSS score of 8.8.
Which versions of PostgreSQL are affected by CVE-2021-32027?
Versions before 13.3, 12.7, 11.12, 10.17, and 9.6.22 of PostgreSQL are affected by CVE-2021-32027.
How can an authenticated database user exploit CVE-2021-32027?
An authenticated database user can exploit CVE-2021-32027 by modifying certain SQL array values to write arbitrary bytes to a wide area of server memory.
Where can I find more information about CVE-2021-32027?
You can find more information about CVE-2021-32027 on the IBM X-Force Exchange website, the IBM Support page, and the Red Hat Bugzilla page.