CVE-2021-32027

CVE-2021-32027

Name

CVE-2021-32027

Description

A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

NVD Severity

high

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
MISC	https://www.postgresql.org/support/security/CVE-2021-32027/
MISC	https://bugzilla.redhat.com/show_bug.cgi?id=1956876
Third Party Advisory	https://security.netapp.com/advisory/ntap-20210713-0004/

Type

URI

MISC

https://www.postgresql.org/support/security/CVE-2021-32027/

MISC

https://bugzilla.redhat.com/show_bug.cgi?id=1956876

Third Party Advisory

https://security.netapp.com/advisory/ntap-20210713-0004/

Match rules

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= 9.6.0	< 9.6.22
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= 10.0	< 10.17
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= 11.0	< 11.12
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= 12.0	< 12.7
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= 13.0	< 13.3

CPE URI

Source package

Min version

Max version