CVE-2021-20229: Medium severity PostgreSQL postgresql vulnerability

Q: What is CVE-2021-20229?

CVE-2021-20229 is a vulnerability found in PostgreSQL versions before 13.2 that allows a user with SELECT privilege on one column to craft a special query to retrieve all columns of the table, posing a confidentiality risk.

Q: What is the severity of CVE-2021-20229?

The severity of CVE-2021-20229 is medium, with a severity score of 4.3.

Q: How does CVE-2021-20229 affect PostgreSQL?

CVE-2021-20229 affects PostgreSQL versions before 13.2, allowing a user with SELECT privilege on one column to retrieve all columns of the table, compromising confidentiality.

Q: What software versions are affected by CVE-2021-20229?

PostgreSQL versions before 13.2 are affected by CVE-2021-20229.

Q: How can I mitigate the risk of CVE-2021-20229?

To mitigate the risk of CVE-2021-20229, update PostgreSQL to version 13.2 or apply the necessary patches provided by the vendor.

Published Feb 4, 2021

Updated

A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

Other sources

A user having SELECT privilege on one column can craft a special query that returns all columns of the table.

The PostgreSQL project thanks Sven Klemm for reporting this problem.

— Red Hat

Affected Software

19 affected componentsFixes available

PostgreSQL postgresql>=13.0<13.2

redhat Software Collections

redhat Enterprise Linux=7.0

redhat Enterprise Linux=8.0

Fedoraproject Fedora=33

redhat/postgresql<13.2

13.2

alpine/postgresql>=13.0<12.6-r0

12.6-r0

alpine/postgresql>=13.0<13.2-r0

13.2-r0

alpine/postgresql>=13.0<13.2-r0

13.2-r0

alpine/postgresql13<13.2-r0

13.2-r0

alpine/postgresql13<13.2-r0

13.2-r0

alpine/postgresql13<13.2-r0

13.2-r0

alpine/postgresql13<13.2-r0

13.2-r0

alpine/postgresql13<13.2-r0

13.2-r0

alpine/postgresql14<13.2-r0

13.2-r0

alpine/postgresql15<13.2-r0

13.2-r0

alpine/postgresql15<13.2-r0

13.2-r0

alpine/postgresql15<13.2-r0

13.2-r0

alpine/postgresql15<13.2-r0

13.2-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/postgresql to a version that resolves this vulnerability.
Fixed in 13.2
Upgrade
Upgrade alpine/postgresql to a version that resolves this vulnerability.
Fixed in 12.6-r0
Upgrade
Upgrade alpine/postgresql to a version that resolves this vulnerability.
Fixed in 13.2-r0
Upgrade
Upgrade alpine/postgresql13 to a version that resolves this vulnerability.
Fixed in 13.2-r0
Upgrade
Upgrade alpine/postgresql14 to a version that resolves this vulnerability.
Fixed in 13.2-r0
Upgrade
Upgrade alpine/postgresql15 to a version that resolves this vulnerability.
Fixed in 13.2-r0
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 13.2

Event History

Feb 4, 2021

Data Sourced

via Red Hat·07:53 PM

DescriptionSeverityAffected Software

Feb 23, 2021

CVE Published

via MITRE·05:40 PM

Data Sourced

via MITRE·05:40 PM

DescriptionWeakness

Data Sourced

via OSV·06:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is CVE-2021-20229?

CVE-2021-20229 is a vulnerability found in PostgreSQL versions before 13.2 that allows a user with SELECT privilege on one column to craft a special query to retrieve all columns of the table, posing a confidentiality risk.

What is the severity of CVE-2021-20229?

The severity of CVE-2021-20229 is medium, with a severity score of 4.3.

How does CVE-2021-20229 affect PostgreSQL?

CVE-2021-20229 affects PostgreSQL versions before 13.2, allowing a user with SELECT privilege on one column to retrieve all columns of the table, compromising confidentiality.

What software versions are affected by CVE-2021-20229?

PostgreSQL versions before 13.2 are affected by CVE-2021-20229.

How can I mitigate the risk of CVE-2021-20229?

To mitigate the risk of CVE-2021-20229, update PostgreSQL to version 13.2 or apply the necessary patches provided by the vendor.

CVE-2021-20229: Medium severity PostgreSQL postgresql vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What is CVE-2021-20229?

What is the severity of CVE-2021-20229?

How does CVE-2021-20229 affect PostgreSQL?

What software versions are affected by CVE-2021-20229?

How can I mitigate the risk of CVE-2021-20229?

Company

Resources

Contact