A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017576 advisory.

    A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on     one column to craft a special query that returns all columns of the table. The highest threat from this     vulnerability is to confidentiality.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A
    user having UPDATE permission but not SELECT permission to a particular column could craft queries which,
    under some circumstances, might disclose values from that column in error messages. An attacker could use
    this flaw to obtain information stored in a column they are allowed to write but not read. (CVE-2021-3393)

  - A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on
    one column to craft a special query that returns all columns of the table. The highest threat from this
    vulnerability is to confidentiality. (CVE-2021-20229)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on     one column to craft a special query that returns all columns of the table. The highest threat from this     vulnerability is to confidentiality. (CVE-2021-20229)

Note that Nessus relies on the presence of the package as reported by the vendor.

For more information about these vulnerabilities, refer to the Postgresql News Page.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202105-32 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the CVE identifiers referenced below for details.
  Impact :

    An authenticated remote attacker, by executing malicious crafted       queries, could possibly disclose sensitive information.
  Workaround :

    There is no known workaround at this time.

The version of PostgreSQL installed on the remote host is 11 prior to 11.11, 12 prior to 12.6, or 13 prior to 13.2. As such, it is potentially affected by multiple vulnerabilities :

  - An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11.
    A user having UPDATE permission but not SELECT permission to a particular column could craft queries     which, under some circumstances, might disclose values from that column in error messages. An attacker     could use this flaw to obtain information stored in a column they are allowed to write but not read.
    (CVE-2021-3393)

  - A flaw was found in PostgreSQL in versions before 13.2, before 12.6, before 11.11. This flaw allows a     user with SELECT privilege on one column to craft a special query that returns all columns of the table.
    The highest threat from this vulnerability is to confidentiality (CVE-2021-20229)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for postgresql13 fixes the following issues :

Upgrade to version 13.2 :

  - Updating stored views and reindexing might be needed     after applying this update.

  - CVE-2021-3393, bsc#1182040: Fix information leakage in     constraint-violation error messages.

  - CVE-2021-20229, bsc#1182039: Fix failure to check     per-column SELECT privileges in some join queries.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql13 fixes the following issues :

Upgrade to version 13.2 :

Updating stored views and reindexing might be needed after applying this update.

CVE-2021-3393, bsc#1182040: Fix information leakage in constraint-violation error messages.

CVE-2021-20229, bsc#1182039: Fix failure to check per-column SELECT privileges in some join queries.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
314010	Unity Linux 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-017576)	Nessus	Unity Linux Local Security Checks	medium
425725	Alpine: postgresql14: security update to 13.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
425725	Alpine: postgresql14: security update to 13.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
425656	Alpine: multiple postgresql15 packages: security update to 13.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
425656	Alpine: multiple postgresql15 packages: security update to 13.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
223662	Linux Distros Unpatched Vulnerability : CVE-2021-20229	Nessus	Misc.	medium
184156	Puppet Enterprise < 2019.8.6 PostgreSQL Vulnerabilities	Nessus	Misc.	medium
406517	Alpine: postgresql13: security update to 13.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406517	Alpine: postgresql13: security update to 13.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
406479	Alpine: postgresql: security update to 13.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406479	Alpine: postgresql: security update to 13.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
406472	Alpine: postgresql: security update to 12.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406472	Alpine: postgresql: security update to 12.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
400264	Alpine: postgresql: security update to 13.1-r2 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400264	Alpine: postgresql: security update to 13.1-r2 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
157026	GLSA-202105-32 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
148419	PostgreSQL 11.x < 11.11 / 12.x < 12.6 / 13.x < 13.2 Multiple Vulnerabilities	Nessus	Databases	medium
146788	SUSE SLED15 / SLES15 Security Update : postgresql13 (SUSE-SU-2021:0543-1)	Nessus	SuSE Local Security Checks	medium
146785	SUSE SLES12 Security Update : postgresql13 (SUSE-SU-2021:0545-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2021-20229

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium