Most recent entries from all

ALSA-2021:2360 — Important: postgresql:9.6 security update

Affected: AlmaLinux:8: postgresql, AlmaLinux:8: postgresql-contrib, AlmaLinux:8: postgresql-docs, AlmaLinux:8: postgresql-plperl, AlmaLinux:8: postgresql-plpython3, AlmaLinux:8: postgresql-pltcl, AlmaLinux:8: postgresql-server, AlmaLinux:8: postgresql-server-devel, AlmaLinux:8: postgresql-static, AlmaLinux:8: postgresql-test and 1 more

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (9.6.22)

Security Fix(es):

* postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

* postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2021-02775

Withdrawn: BELL-CVE-2021-32028 — CVE-2021-32028 does not affect BellSoft software

Withdrawn by the publisher.

BIT-postgresql-2021-32028

Affected: Bitnami: postgresql

A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.

certfr-2021-avi-381 — De multiples vulnérabilités ont été découvertes dans PostgreSQL. Elles permettent à un attaquant de provoquer une attei…

certfr-2021-avi-381

Withdrawn: CLEANSTART-2026-FW42039 — vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row secur…

Withdrawn by the publisher.

Affected: CleanStart: postgresql

Multiple security vulnerabilities affect the postgresql package. A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. See references for individual vulnerability details.

EUVD-2026-27812

fkie_cve-2021-32028

GHSA-fr87-j862-8rwm

gsd-2021-32028

ICSA-22-111-03 — Hitachi Energy MicroSCADA Pro/X SYS600

The Raccoon attack exploits a flaw in the TLS specification that can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. This would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note this vulnerability only impacts DH ciphersuites and not ECDH ciphersuites. This vulnerability affects OpenSSL 1.0.2, which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).CVE-2020-1968 has been assigned to this vulnerability. A CVSS v3 base score of 3.7 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Node.js versions prior to 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two transfer-encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP request smuggling.CVE-2020-8265 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Node.js versions prior to 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two transfer-encoding header fiel…

OESA-2021-1439 — postgresql security update

Affected: openEuler:20.03-LTS-SP1: postgresql, openEuler:20.03-LTS-SP2: postgresql

PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL constructs (including transactions, subselects and user-defined types and functions). The postgresql package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server. Security Fix(es): A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.(CVE-2021-32028)

openSUSE-SU-2021:0894-1 — Security update for postgresql10

Security update for postgresql10

RHBA-2021:3472 — Red Hat Bug Fix Advisory: Red Hat Ansible Tower 3.8.4-1 - Container

nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name libX11: missing request length checks postgresql: Buffer overrun from integer overflow in array subscripting calculations postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE

SUSE-SU-2021:1782-1 — Security update for postgresql10

Security update for postgresql10

UBUNTU-CVE-2021-32028

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12

WID-SEC-W-2022-1241 — PostgreSQL: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen und um Informationen offenzulegen.