Read the docs
TI-2021-02616 Aliases CVE-2021-3677GHSA-j859-w9g7-8276

Information disclosure in postgresql

Priority LOW 32CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.

Why it matters now

EPSS 0.01442 73rd percentileScored 2026-11-07
Fix Fixed Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—postgresqlFixedin v13.4, v12.8, v11.13—No fix listedCNA
  • postgresql Vendor— Affected Fixedin v13.4, v12.8, v11.13 Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*11.0 to before 11.13; 12.0 to before 12.8; 13.0 to before 13.4VulnerablePostgreSQL
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions 11.0 to before 11.13; 12.0 to before 12.8; 13.0 to before 13.4 Vulnerable ·PostgreSQL
  • cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject

Remediation

Red Hat 5 advisories

  • RHSA-2022:4931 Released 2022-06-07 · Red Hat rating Moderate
    RHV Appliance (rhvm-appliance) security update [ovirt-4.5.0]
    • Red Hat Virtualization 4 Hypervisor for RHEL 8 rhvm-appliance-2:4.5-20220603.1.el8ev
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance-2:4.5-20220603.1.el8ev
  • RHSA-2021:5236 Released 2021-12-21 · Red Hat rating Moderate
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13 +47
  • RHSA-2021:5235 Released 2021-12-21 · Red Hat rating Moderate
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.aarch64::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.s390x::postgresql:12 +47
Show 2 more Red Hat advisories
  • RHSA-2021:5197 Released 2021-12-16 · Red Hat rating Moderate
    rh-postgresql12-postgresql security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-postgresql12-postgresql-12.9-1.el7, rh-postgresql12-postgresql-contrib-12.9-1.el7, rh-postgresql12-postgresql-contrib-syspaths-12.9-1.el7 +11
    • Red Hat Software Collections for RHEL(v. 7) rh-postgresql12-postgresql-12.9-1.el7, rh-postgresql12-postgresql-contrib-12.9-1.el7, rh-postgresql12-postgresql-contrib-syspaths-12.9-1.el7 +11
  • RHSA-2021:5179 Released 2021-12-16 · Red Hat rating Moderate
    rh-postgresql13-postgresql security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-postgresql13-postgresql-13.5-1.el7, rh-postgresql13-postgresql-contrib-13.5-1.el7, rh-postgresql13-postgresql-contrib-syspaths-13.5-1.el7 +12
    • Red Hat Software Collections for RHEL(v. 7) rh-postgresql13-postgresql-13.5-1.el7, rh-postgresql13-postgresql-contrib-13.5-1.el7, rh-postgresql13-postgresql-contrib-syspaths-13.5-1.el7 +12

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:5235, RHSA-2021:5236
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2021:5179, RHSA-2021:5197
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2021:5179, RHSA-2021:5197
Red Hat Virtualization 4 Hypervisor for RHEL 8Fixed RHSA-2022:4931
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2022:4931
Not affected: 14 products
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat Integration Service Registry
  • Red Hat JBoss Fuse 6
  • Red Hat Process Automation 7
  • Red Hat Software Collections
  • Red Hat build of Debezium 1
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3677
  2. 2026-10-03 Alias added: GHSA-j859-w9g7-8276

References

Advisory 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences