CVE-2021-3393

An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.

An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.

An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (12.7)

Security Fix(es):

• postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

• postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

• postgresql: Memory disclosure in partitioned-table UPDATE ... RETURNING (CVE-2021-32029)

• postgresql: Partition constraint violation errors leak values of denied columns (CVE-2021-3393)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (12.7)

Security Fix(es):

• postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

• postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

• postgresql: Memory disclosure in partitioned-table UPDATE ... RETURNING (CVE-2021-32029)

• postgresql: Partition constraint violation errors leak values of denied columns (CVE-2021-3393)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.

A user having an UPDATE privilege on a partitioned table but lacking the SELECT privilege on some column may be able to acquire denied-column values from an error message (CVE-2021-3393).

A user having a SELECT privilege on an individual column can craft a special query that returns all columns of the table. Additionally, a stored view that uses column-level privileges will have incomplete column-usage bitmaps. In installations that depend on column-level permissions for security, it is recommended to execute CREATE OR REPLACE on all user-defined views to force them to be re-parsed (CVE-2021-20229).

PostgreSQL 11 was only affected by CVE-2021-3393 and both PostgreSQL 11 and 13 were affected by CVE-2021-20229. PostgreSQL 9.6 was updated to fix bugs.

This update for postgresql12 fixes the following issues:

Upgrade to version 12.6:

• Reindexing might be needed after applying this update.
• CVE-2021-3393, bsc#1182040: Fix information leakage in constraint-violation error messages.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the postgresql11-11.13-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql12-12.8-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libecpg6-13.4-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql14-14.5-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql15-15.4-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql16-16.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql17-17.6-2.1 package on the GA media of openSUSE Tumbleweed.

This update for postgresql13 fixes the following issues:

Upgrade to version 13.2:

• Updating stored views and reindexing might be needed after applying this update.
• CVE-2021-3393, bsc#1182040: Fix information leakage in constraint-violation error messages.
• CVE-2021-20229, bsc#1182039: Fix failure to check per-column SELECT privileges in some join queries.

This update for postgresql12 fixes the following issues:

Upgrade to version 12.6:

• Reindexing might be needed after applying this update.
• CVE-2021-3393, bsc#1182040: Fix information leakage in constraint-violation error messages.

This update for postgresql13 fixes the following issues:

Upgrade to version 13.2:

• Updating stored views and reindexing might be needed after applying this update.
• CVE-2021-3393, bsc#1182040: Fix information leakage in constraint-violation error messages.
• CVE-2021-20229, bsc#1182039: Fix failure to check per-column SELECT privileges in some join queries.

This update for postgresql12 fixes the following issues:

Upgrade to version 12.6:

• Reindexing might be needed after applying this update.
• CVE-2021-3393, bsc#1182040: Fix information leakage in constraint-violation error messages.

This update for postgresql12 fixes the following issues:

• Upgrade to version 12.7:

• CVE-2021-32027: Fixed integer overflows in array subscripting calculations (bsc#1185924).

• CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists (bsc#1185925).

• CVE-2021-32029: Fixed possibly-incorrect computation of UPDATE ... RETURNING 'pg_psql_temporary_savepoint' does not exist (bsc#1185926).

• CVE-2021-3393: Fixed information leakage in constraint-violation error messages (bsc#1182040).

• Don't use %_stop_on_removal, because it was meant to be private and got removed from openSUSE. %_restart_on_update is also private, but still supported and needed for now (bsc#1183168).

• Re-enable build of the llvmjit subpackage on SLE, but it will only be delivered on PackageHub for now (bsc#1183118).

• Disable icu for PostgreSQL 10 (and older) on TW (bsc#1179945).

Heikki Linnakangas discovered that PostgreSQL incorrectly leaked values of denied columns when handling certain errors. A remote attacker could possibly use this issue to obtain sensitive information.