CVE-2021-32027
published 2021-06-01CVE-2021-32027: A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values…
PriorityP357high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.99%
78.4th percentile
A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | postgresql-13 | < postgresql-13 13.3-1 (bullseye) | postgresql-13 13.3-1 (bullseye) |
| msrc | cm1_postgresql_12.7-1_on_cbl_mariner_1.0 | — | — |
| postgresql | postgresql | — | — |
| postgresql | postgresql | >= 10.0 < 10.17 | 10.17 |
| postgresql | postgresql | >= 11.0 < 11.12 | 11.12 |
| postgresql | postgresql | >= 12.0 < 12.7 | 12.7 |
| postgresql | postgresql | >= 13.0 < 13.3 | 13.3 |
| postgresql | postgresql | >= 9.6.0 < 9.6.22 | 9.6.22 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | jboss_enterprise_application_platform | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_msrc8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Hitachi Energy MicroSCADA X DMS600
cisa_ics·2022-10-25·CVSS 8.8
[HIGH] Hitachi Energy MicroSCADA X DMS600
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Hitachi Energy MicroSCADA X DMS600
Last RevisedOctober 25, 2022
Alert CodeICSA-22-298-04
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.8
- ATTENTION: Exploitable remotely/Low attack complexity
- Vendor: Hitachi Energy
- Equipment: DMS600
- Vulnerability: Reliance on Uncontrolled Component
## 2. RISK EVALUATION
Successful exploitation of this vulnerabilities could allow an attacker to gain unauthorized access to information.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following Hitachi Energy product, integrated with MicroSCADA X, is affected:
- DMS600: Version 4.5
## 3
Ubuntu
PostgreSQL vulnerabilities
vendor_ubuntu·2022-09-28·CVSS 8.1
CVE-2021-23214 [HIGH] PostgreSQL vulnerabilities
Title: PostgreSQL vulnerabilities
Summary: Several security issues were fixed in PostgreSQL.
Jacob Champion discovered that PostgreSQL incorrectly handled SSL
certificate verification and encryption. A remote attacker could possibly
use this issue to inject arbitrary SQL queries when a connection is first
established. (CVE-2021-23214)
Tom Lane discovered that PostgreSQL incorrect handled certain array
subscripting calculations. An authenticated attacker could possibly use
this issue to overwrite server memory and escalate privileges.
(CVE-2021-32027)
Instructions: In general, a standard system update will make all the necessary changes.
CISA ICS
Hitachi Energy MicroSCADA Pro/X SYS600
cisa_ics·2022-04-21
Hitachi Energy MicroSCADA Pro/X SYS600
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Hitachi Energy MicroSCADA Pro/X SYS600
Last RevisedApril 21, 2022
Alert CodeICSA-22-111-03
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Hitachi Energy
- Equipment: MicroSCADA Pro/X SYS600
- Vulnerabilities: Observable Discrepancy, HTTP Request Smuggling, Classic Buffer Overflow, Improper Certificate Validation, Improper Restriction of Operations within the Bounds of a Memory Buffer, Exposure of Sensitive Information to an Unauthorized Actor
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities coul
Microsoft
A flaw was found in postgresql in versions before 13.3 before 12.7 before 11.12 before 10.17 and before 9.6.22. While modifying certain SQL array values missing bounds checks let authenticated databas
vendor_msrc·2021-06-08·CVSS 8.8
CVE-2021-32027 [HIGH] CWE-190 A flaw was found in postgresql in versions before 13.3 before 12.7 before 11.12 before 10.17 and before 9.6.22. While modifying certain SQL array values missing bounds checks let authenticated databas
A flaw was found in postgresql in versions before 13.3 before 12.7 before 11.12 before 10.17 and before 9.6.22. While modifying certain SQL array values missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency i
Ubuntu
PostgreSQL vulnerabilities
vendor_ubuntu·2021-06-01·CVSS 8.8
CVE-2021-32029 [HIGH] PostgreSQL vulnerabilities
Title: PostgreSQL vulnerabilities
Summary: Several security issues were fixed in PostgreSQL.
Tom Lane discovered that PostgreSQL incorrect handled certain array
subscripting calculations. An authenticated attacker could possibly use
this issue to overwrite server memory and escalate privileges.
(CVE-2021-32027)
Andres Freund discovered that PostgreSQL incorrect handled certain
INSERT ... ON CONFLICT ... DO UPDATE commands. A remote attacker could
possibly use this issue to read server memory and obtain sensitive
information. (CVE-2021-32028)
Tom Lane discovered that PostgreSQL incorrect handled certain UPDATE ...
RETURNING commands. A remote attacker could possibly use this issue to read
server memory and obtain sensitive information. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 2
Red Hat
postgresql: Buffer overrun from integer overflow in array subscripting calculations
vendor_redhat·2021-05-13·CVSS 8.8
CVE-2021-32027 [HIGH] CWE-190 postgresql: Buffer overrun from integer overflow in array subscripting calculations
postgresql: Buffer overrun from integer overflow in array subscripting calculations
A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in postgresql. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Statement: Writing arbitrary b
Debian
CVE-2021-32027: postgresql-13 - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.1...
vendor_debian·2021·CVSS 8.8
CVE-2021-32027 [HIGH] CVE-2021-32027: postgresql-13 - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.1...
A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Scope: local
bullseye: resolved (fixed in 13.3-1)
OSV
postgresql-9.5 vulnerabilities
osv·2022-09-28·CVSS 8.1
CVE-2021-23214 [HIGH] postgresql-9.5 vulnerabilities
postgresql-9.5 vulnerabilities
Jacob Champion discovered that PostgreSQL incorrectly handled SSL
certificate verification and encryption. A remote attacker could possibly
use this issue to inject arbitrary SQL queries when a connection is first
established. (CVE-2021-23214)
Tom Lane discovered that PostgreSQL incorrect handled certain array
subscripting calculations. An authenticated attacker could possibly use
this issue to overwrite server memory and escalate privileges.
(CVE-2021-32027)
GHSA
GHSA-8rj6-p58w-wpr2: A flaw was found in postgresql in versions before 13
ghsa_unreviewed·2022-05-24
CVE-2021-32027 [HIGH] CWE-119 GHSA-8rj6-p58w-wpr2: A flaw was found in postgresql in versions before 13
A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
OSV
CVE-2021-32027: A flaw was found in postgresql in versions before 13
osv·2021-06-01·CVSS 8.8
CVE-2021-32027 [HIGH] CVE-2021-32027: A flaw was found in postgresql in versions before 13
A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
OSV
postgresql-10, postgresql-12, postgresql-13 vulnerabilities
osv·2021-06-01·CVSS 8.8
CVE-2021-32027 [HIGH] postgresql-10, postgresql-12, postgresql-13 vulnerabilities
postgresql-10, postgresql-12, postgresql-13 vulnerabilities
Tom Lane discovered that PostgreSQL incorrect handled certain array
subscripting calculations. An authenticated attacker could possibly use
this issue to overwrite server memory and escalate privileges.
(CVE-2021-32027)
Andres Freund discovered that PostgreSQL incorrect handled certain
INSERT ... ON CONFLICT ... DO UPDATE commands. A remote attacker could
possibly use this issue to read server memory and obtain sensitive
information. (CVE-2021-32028)
Tom Lane discovered that PostgreSQL incorrect handled certain UPDATE ...
RETURNING commands. A remote attacker could possibly use this issue to read
server memory and obtain sensitive information. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-5869 postgresql: Buffer overrun from integer overflow in array modification
bugzilla·2023-10-31·CVSS 8.8
CVE-2023-5869 [HIGH] CVE-2023-5869 postgresql: Buffer overrun from integer overflow in array modification
CVE-2023-5869 postgresql: Buffer overrun from integer overflow in array modification
While modifying certain SQL array values, missing overflow checks let authenticated database users write arbitrary bytes to a memory area that
facilitates arbitrary code execution. Missing overflow checks also let authenticated database users read a wide area of server memory. The CVE-2021-32027 fix covered some attacks of this description, but it missed others.
Discussion:
This CVE is public now (lifting embargo...)
https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/
---
Created mingw-postgresql tracking bugs for this issue:
Affects: fedora-all [bug 2249042]
Created postgresql tracking bugs for this issue:
Affects: fedora-all [bug 2249041]
Created pos
Bugzilla
CVE-2021-32027 postgresql: Buffer overrun from integer overflow in array subscripting calculations
bugzilla·2021-05-04·CVSS 8.8
CVE-2021-32027 [HIGH] CVE-2021-32027 postgresql: Buffer overrun from integer overflow in array subscripting calculations
CVE-2021-32027 postgresql: Buffer overrun from integer overflow in array subscripting calculations
While modifying certain SQL array values, missing bounds checks let
authenticated database users write arbitrary bytes to a wide area of server
memory.
Discussion:
Upstream fix:
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=f02b9085ad2f6fefd9c5cdf85579cb9f0ff0f0ea [master]
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=467395bfdf33f1ccf67ca388ffdcc927271544cb [REL_13_STABLE]
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=3b0f6a7ae5d812d9a70fc854d2e54d3657467e25 [REL_12_STABLE]
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=06bfbe85409177bff7bc5376fb5fdd7a324227c3 [REL_11_STABLE]
https://git.postgresql.org/gitweb/?p=postgresql
https://bugzilla.redhat.com/show_bug.cgi?id=1956876https://security.gentoo.org/glsa/202211-04https://security.netapp.com/advisory/ntap-20210713-0004/https://www.postgresql.org/support/security/CVE-2021-32027/https://bugzilla.redhat.com/show_bug.cgi?id=1956876https://security.gentoo.org/glsa/202211-04https://security.netapp.com/advisory/ntap-20210713-0004/https://www.postgresql.org/support/security/CVE-2021-32027/
2021-06-01
Published