CVE-2021-20229

Description

A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

How to fix CVE-2021-20229

To remediate CVE-2021-20229, upgrade the affected package to a fixed version below.

• Alpine/postgresql—upgrade to 12.6-r0 or later
• —upgrade to 13.2-r0 or later
• —upgrade to 13.2-r0 or later
• —upgrade to 13.2-r0 or later
• —upgrade to 13.2.0 or later
• —upgrade to 13.2-1 or later

Is CVE-2021-20229 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

• from 0, < 12.6-r0
• from 0, < 13.2-r0
• from 0, < 13.2-r0
• from 0, < 13.2-r0
• >= 13.0.0, < 13.2.0
• from 0, < 13.2-1

CVSS scores

References (6)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2021-20229
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-20229
• WEBbugzilla.redhat.com/show_bug.cgi?id=1925296
• WEBnvd.nist.gov/vuln/detail/CVE-2021-20229
• WEB