Release Date: | 2021-04-01 |
An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.
See more information about CVE-2021-3393 from MITRE CVE dictionary and NIST NVD
NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.
Base Score: | 4.3 | Base Metrics: | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Access Vector: | Network | Attack Complexity: | Low |
Privileges Required: | Low | User Interaction: | None |
Scope: | Unchanged | Confidentiality Impact: | Low |
Integrity Impact: | None | Availability Impact: | None |
Platform | Errata | Release Date |
Oracle Linux version 8 (pgaudit) | ELSA-2021-2372 | 2021-06-11 |
Oracle Linux version 8 (postgres-decoderbufs) | ELSA-2021-2372 | 2021-06-11 |
Oracle Linux version 8 (postgresql) | ELSA-2021-2372 | 2021-06-11 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team