CVE-2021-32027: Buffer Overflow

Q: What is the vulnerability ID for this flaw in PostgreSQL?

The vulnerability ID for this flaw in PostgreSQL is CVE-2021-32027.

Q: What is the severity level of CVE-2021-32027?

The severity level of CVE-2021-32027 is high, with a CVSS score of 8.8.

Q: Which versions of PostgreSQL are affected by CVE-2021-32027?

Versions before 13.3, 12.7, 11.12, 10.17, and 9.6.22 of PostgreSQL are affected by CVE-2021-32027.

Q: How can an authenticated database user exploit CVE-2021-32027?

An authenticated database user can exploit CVE-2021-32027 by modifying certain SQL array values to write arbitrary bytes to a wide area of server memory.

Q: Where can I find more information about CVE-2021-32027?

You can find more information about CVE-2021-32027 on the IBM X-Force Exchange website, the IBM Support page, and the Red Hat Bugzilla page.

Published May 4, 2021

Updated

A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Other sources

PostgreSQL could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an integer overflow while modifying certain SQL array values. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

— IBM

Affected Software

18 affected componentsFixes available

redhat/postgresql<13.3

13.3

redhat/postgresql<12.7

12.7

redhat/postgresql<11.12

11.12

redhat/postgresql<10.17

10.17

redhat/postgresql<9.6.22

9.6.22

IBM DRM<=2.0.6

PostgreSQL postgresql>=9.6.0<9.6.22

PostgreSQL postgresql>=10.0<10.17

PostgreSQL postgresql>=11.0<11.12

PostgreSQL postgresql>=12.0<12.7

PostgreSQL postgresql>=13.0<13.3

redhat JBoss Enterprise Application Platform=7.0.0

redhat Software Collections

redhat Enterprise Linux=7.0

redhat Enterprise Linux=8.0

F5 BIG-IP=17.1.0

17.1.1

F5 BIG-IP>=16.1.0<=16.1.6

F5 BIG-IP>=15.1.0<=15.1.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade F5 BIG-IP and BIG-IQ Centralized Management to a version that resolves this vulnerability.
Fixed in 17.1.1
Upgrade
Upgrade redhat/postgresql to a version that resolves this vulnerability.
Fixed in 13.3
Upgrade
Upgrade redhat/postgresql to a version that resolves this vulnerability.
Fixed in 12.7
Upgrade
Upgrade redhat/postgresql to a version that resolves this vulnerability.
Fixed in 11.12
Upgrade
Upgrade redhat/postgresql to a version that resolves this vulnerability.
Fixed in 10.17
Upgrade
Upgrade redhat/postgresql to a version that resolves this vulnerability.
Fixed in 9.6.22
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 13.3
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 12.7
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 11.12
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 10.17
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 9.6.22

Event History

May 4, 2021

Data Sourced

via Red Hat·03:13 PM

DescriptionSeverityAffected Software

Jun 1, 2021

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Apr 29, 2025

Advisory Published

via F5·07:01 PM

Parent advisories

This vulnerability appears in the following advisories.

IBM-6497499

Frequently Asked Questions

What is the vulnerability ID for this flaw in PostgreSQL?

The vulnerability ID for this flaw in PostgreSQL is CVE-2021-32027.

What is the severity level of CVE-2021-32027?

The severity level of CVE-2021-32027 is high, with a CVSS score of 8.8.

Which versions of PostgreSQL are affected by CVE-2021-32027?