Most recent entries from all

ALSA-2021:2360 — Important: postgresql:9.6 security update

Affected: AlmaLinux:8: postgresql, AlmaLinux:8: postgresql-contrib, AlmaLinux:8: postgresql-docs, AlmaLinux:8: postgresql-plperl, AlmaLinux:8: postgresql-plpython3, AlmaLinux:8: postgresql-pltcl, AlmaLinux:8: postgresql-server, AlmaLinux:8: postgresql-server-devel, AlmaLinux:8: postgresql-static, AlmaLinux:8: postgresql-test and 1 more

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (9.6.22)

Security Fix(es):

* postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

* postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2021-02776

Withdrawn: BELL-CVE-2021-32027 — CVE-2021-32027 does not affect BellSoft software

Withdrawn by the publisher.

BIT-postgresql-2021-32027

Affected: Bitnami: postgresql

A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

certfr-2021-avi-381 — De multiples vulnérabilités ont été découvertes dans PostgreSQL. Elles permettent à un attaquant de provoquer une attei…

certfr-2021-avi-381

Withdrawn: CLEANSTART-2026-FW42039 — vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row secur…

Withdrawn by the publisher.

Affected: CleanStart: postgresql

Multiple security vulnerabilities affect the postgresql package. A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. See references for individual vulnerability details.

EUVD-2026-27798

fkie_cve-2021-32027

GHSA-8rj6-p58w-wpr2

gsd-2021-32027

ICSA-22-111-03 — Hitachi Energy MicroSCADA Pro/X SYS600

The Raccoon attack exploits a flaw in the TLS specification that can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. This would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note this vulnerability only impacts DH ciphersuites and not ECDH ciphersuites. This vulnerability affects OpenSSL 1.0.2, which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).CVE-2020-1968 has been assigned to this vulnerability. A CVSS v3 base score of 3.7 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Node.js versions prior to 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two transfer-encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP request smuggling.CVE-2020-8265 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Node.js versions prior to 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two transfer-encoding header fiel…

msrc_CVE-2021-32027 — A flaw was found in postgresql in versions before 13.3 before 12.7 before 11.12 before 10.17 and before 9.6.22. While m…

msrc_CVE-2021-32027

openSUSE-SU-2021:0894-1 — Security update for postgresql10

Security update for postgresql10

RHBA-2021:3472 — Red Hat Bug Fix Advisory: Red Hat Ansible Tower 3.8.4-1 - Container

nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name libX11: missing request length checks postgresql: Buffer overrun from integer overflow in array subscripting calculations postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE

SUSE-SU-2021:1782-1 — Security update for postgresql10

Security update for postgresql10

UBUNTU-CVE-2021-32027

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12

WID-SEC-W-2022-1241 — PostgreSQL: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen und um Informationen offenzulegen.