CVE-2021-32028: Infoleak
A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.
Other sources
PostgreSQL could allow a remote authenticated attacker to obtain sensitive information, caused by a memory disclosure vulnerability when using an INSERT … ON CONFLICT … DO UPDATE command on a purpose-crafted table. By creating prerequisite objects, an attacker could exploit this vulnerability to read arbitrary bytes of server memory.
— IBM
Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and complete this attack at will. A user lacking the CREATE and TEMPORARY privileges on all databases and the CREATE privilege on all schemas cannot use this attack at will.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-32028?
CVE-2021-32028 is a vulnerability in PostgreSQL that allows a remote authenticated attacker to obtain sensitive information.
What is the severity of CVE-2021-32028?
The severity of CVE-2021-32028 is medium with a CVSS score of 6.5.
Which software is affected by CVE-2021-32028?
CVE-2021-32028 affects PostgreSQL versions 9.6.0 to 9.6.22, 10.0 to 10.17, 11.0 to 11.12, 12.0 to 12.7, and 13.0 to 13.3.
How can an attacker exploit CVE-2021-32028?
An attacker can exploit CVE-2021-32028 by using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table to obtain sensitive information.
Are there any references for CVE-2021-32028?
Yes, you can find more information about CVE-2021-32028 at the following references: [1] [2] [3]