GLSA
Advocate
Joined: 12 May 2004
Posts: 2663
|
 Posted: Thu May 27, 2021 2:26 pm Post subject: [ GLSA 202105-32 ] PostgreSQL |
 |
|
Gentoo Linux Security Advisory
Title: PostgreSQL: Multiple vulnerabilities (GLSA 202105-32)
Severity: low
Exploitable: local, remote
Date: 2021-05-26
Bug(s): #771942
ID: 202105-32
Synopsis
Multiple vulnerabilities have been found in PostgreSQL, the worst
of which could result in information disclosure.
Background
PostgreSQL is an open source object-relational database management
system.
Affected Packages
Package: dev-db/postgresql
Vulnerable: < 13.2
Unaffected: >= 9.5.25
Unaffected: >= 9.6.21
Unaffected: >= 10.16
Unaffected: >= 11.11
Unaffected: >= 12.6
Unaffected: >= 13.2
Architectures: All supported architectures
Description
Multiple vulnerabilities have been discovered in PostgreSQL. Please
review the CVE identifiers referenced below for details.
Impact
An authenticated remote attacker, by executing malicious crafted
queries, could possibly disclose sensitive information.
Workaround
There is no known workaround at this time.
Resolution
All PostgreSQL 9.5.x users should upgrade to the latest version: | Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.5.25:9.5"
|
All PostgreSQL 9.6.x users should upgrade to the latest version: | Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.6.21:9.6"
|
All PostgreSQL 10.x users should upgrade to the latest version: | Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/postgresql-10.16:10"
|
All PostgreSQL 11.x users should upgrade to the latest version: | Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/postgresql-11.11:11"
|
All PostgreSQL 12.x users should upgrade to the latest version: | Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/postgresql-12.6:12"
|
All PostgreSQL 13.x users should upgrade to the latest version: | Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/postgresql-13.2:13"
|
References
CVE-2021-20229
CVE-2021-3393 |
|
News & Announcements
