A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

For more information about these vulnerabilities, refer to the Postgresql News Page.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202105-32 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the CVE identifiers referenced below for details.
  Impact :

    An authenticated remote attacker, by executing malicious crafted       queries, could possibly disclose sensitive information.
  Workaround :

    There is no known workaround at this time.

The version of PostgreSQL installed on the remote host is 11 prior to 11.11, 12 prior to 12.6, or 13 prior to 13.2. As such, it is potentially affected by multiple vulnerabilities :

  - An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11.
    A user having UPDATE permission but not SELECT permission to a particular column could craft queries     which, under some circumstances, might disclose values from that column in error messages. An attacker     could use this flaw to obtain information stored in a column they are allowed to write but not read.
    (CVE-2021-3393)

  - A flaw was found in PostgreSQL in versions before 13.2, before 12.6, before 11.11. This flaw allows a     user with SELECT privilege on one column to craft a special query that returns all columns of the table.
    The highest threat from this vulnerability is to confidentiality (CVE-2021-20229)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for postgresql13 fixes the following issues :

Upgrade to version 13.2 :

  - Updating stored views and reindexing might be needed     after applying this update.

  - CVE-2021-3393, bsc#1182040: Fix information leakage in     constraint-violation error messages.

  - CVE-2021-20229, bsc#1182039: Fix failure to check     per-column SELECT privileges in some join queries.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql13 fixes the following issues :

Upgrade to version 13.2 :

Updating stored views and reindexing might be needed after applying this update.

CVE-2021-3393, bsc#1182040: Fix information leakage in constraint-violation error messages.

CVE-2021-20229, bsc#1182039: Fix failure to check per-column SELECT privileges in some join queries.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
184156	Puppet Enterprise < 2019.8.6 PostgreSQL Vulnerabilities	Nessus	Misc.	medium
157026	GLSA-202105-32 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
148419	PostgreSQL 11.x < 11.11 / 12.x < 12.6 / 13.x < 13.2 Multiple Vulnerabilities	Nessus	Databases	medium
146788	SUSE SLED15 / SLES15 Security Update : postgresql13 (SUSE-SU-2021:0543-1)	Nessus	SuSE Local Security Checks	medium
146785	SUSE SLES12 Security Update : postgresql13 (SUSE-SU-2021:0545-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2021-20229

medium

Tenable Plugins

medium

medium

medium

medium

medium