Every CVE Search/ Get API key

CVE-2021-20229

Incorrect Authorization in PostgreSQL

4.3 MediumFix available

A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

1.47%Up 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 4.3

A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

Record
CVE-2021-20229
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
CVE List No score

A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

Record
CVE-2021-20229
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2021-7668 No score

A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

Record
EUVD-2021-7668
Updated
2026-11-03
GitHub AdvisoriesGHSA-43rr-wcj9-h45w 4.3

Incorrect Authorization in PostgreSQL

A flaw was found in PostgreSQL in versions before 13.2, before 12.6, before 11.11, before 10.16, before 9.6.21 and before 9.5.25. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

Record
GHSA-43rr-wcj9-h45w
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVALPINE-CVE-2021-20229 4.3

A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

Record
ALPINE-CVE-2021-20229
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-03
OSVBELL-CVE-2021-20229 4.3

CVE-2021-20229 does not affect BellSoft software

Record
BELL-CVE-2021-20229
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 12 moreShow less
OSV 4.3

A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

Record
CVE-2021-20229
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2021-20229 4.3

A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

Record
DEBIAN-CVE-2021-20229
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVOESA-2021-1124 4.3

postgresql security update

PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL constructs (including transactions, subselects and user-defined types and functions). The postgresql package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server.

Security Fix(es):

A flaw was found in PostgreSQL in versions before 13.2, before 12.6, before 11.11, before 10.16, before 9.6.21 and before 9.5.25. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.(CVE-2021-20229)

Record
OESA-2021-1124
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVBIT-postgresql-2021-20229 No score

A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

Record
BIT-postgresql-2021-20229
Updated
2026-11-02
OSVMGASA-2021-0121 No score

Updated postgresql packages fix security vulnerabilities

A user having an UPDATE privilege on a partitioned table but lacking the SELECT privilege on some column may be able to acquire denied-column values from an error message (CVE-2021-3393).

A user having a SELECT privilege on an individual column can craft a special query that returns all columns of the table. Additionally, a stored view that uses column-level privileges will have incomplete column-usage bitmaps. In installations that depend on column-level permissions for security, it is recommended to execute CREATE OR REPLACE on all user-defined views to force them to be re-parsed (CVE-2021-20229).

PostgreSQL 11 was only affected by CVE-2021-3393 and both PostgreSQL 11 and 13 were affected by CVE-2021-20229. PostgreSQL 9.6 was updated to fix bugs.

Record
MGASA-2021-0121
Updated
2026-11-02
OSVopenSUSE-SU-2024:11187-1 No score

libecpg6-13.4-1.3 on GA media

These are all security issues fixed in the libecpg6-13.4-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11187-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12387-1 No score

postgresql14-14.5-2.1 on GA media

These are all security issues fixed in the postgresql14-14.5-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12387-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13243-1 No score

postgresql15-15.4-2.1 on GA media

These are all security issues fixed in the postgresql15-15.4-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13243-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14360-1 No score

postgresql16-16.4-1.1 on GA media

These are all security issues fixed in the postgresql16-16.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14360-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15580-1 No score

postgresql17-17.6-2.1 on GA media

These are all security issues fixed in the postgresql17-17.6-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15580-1
Updated
2026-11-02
OSVSUSE-SU-2021:0543-1 No score

Security update for postgresql13

This update for postgresql13 fixes the following issues:

Upgrade to version 13.2:

  • Updating stored views and reindexing might be needed after applying this update.
  • CVE-2021-3393, bsc#1182040: Fix information leakage in constraint-violation error messages.
  • CVE-2021-20229, bsc#1182039: Fix failure to check per-column SELECT privileges in some join queries.
Record
SUSE-SU-2021:0543-1
Updated
2026-11-02
OSVSUSE-SU-2021:0545-1 No score

Security update for postgresql13

This update for postgresql13 fixes the following issues:

Upgrade to version 13.2:

  • Updating stored views and reindexing might be needed after applying this update.
  • CVE-2021-3393, bsc#1182040: Fix information leakage in constraint-violation error messages.
  • CVE-2021-20229, bsc#1182039: Fix failure to check per-column SELECT privileges in some join queries.
Record
SUSE-SU-2021:0545-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
postgresql
Alpine:v3.12
 13.0 up to 12.6-r0
12.6-r0
postgresql
Alpine:v3.13
 13.0 up to 13.2-r0
13.2-r0
postgresql
Alpine:v3.14
 13.0 up to 13.2-r0
13.2-r0
postgresql13
Alpine:v3.15
 before 13.2-r0
13.2-r0
postgresql13
Alpine:v3.16
 before 13.2-r0
13.2-r0
postgresql13
Alpine:v3.17
 before 13.2-r0
13.2-r0
postgresql13
Alpine:v3.18
 before 13.2-r0
13.2-r0
postgresql13
Alpine:v3.19
 before 13.2-r0
13.2-r0
postgresql14
Alpine:v3.15
 before 13.2-r0
13.2-r0
postgresql14
Alpine:v3.16
 before 13.2-r0
13.2-r0
Show 27 moreShow less
Affected packages
PackageAffectedFixed
postgresql14
Alpine:v3.17
 before 13.2-r0
13.2-r0
postgresql14
Alpine:v3.18
 before 13.2-r0
13.2-r0
postgresql14
Alpine:v3.19
 before 13.2-r0
13.2-r0
postgresql14
Alpine:v3.20
 before 13.2-r0
13.2-r0
postgresql15
Alpine:v3.17
 before 13.2-r0
13.2-r0
postgresql15
Alpine:v3.18
 before 13.2-r0
13.2-r0
postgresql15
Alpine:v3.19
 before 13.2-r0
13.2-r0
postgresql15
Alpine:v3.20
 before 13.2-r0
13.2-r0
postgresql
Bitnami
 13.0.0 up to 13.2.0
13.2.0
postgresql-13
Debian:11
 before 13.2-1
13.2-1
postgresql9.6
Mageia:7
From an advisory covering 2 CVEs
 before 9.6.21-1.mga7
9.6.21-1.mga7
postgresql11
Mageia:7
From an advisory covering 2 CVEs
 before 11.11-1.mga7
11.11-1.mga7
postgresql11
Mageia:8
From an advisory covering 2 CVEs
 before 11.11-1.mga8
11.11-1.mga8
postgresql13
Mageia:8
From an advisory covering 2 CVEs
 before 13.2-1.mga8
13.2-1.mga8
postgresql
openEuler:20.03-LTS
 before 10.5-21.oe1
10.5-21.oe1
postgresql
openEuler:20.03-LTS-SP1
 before 10.5-21.oe1
10.5-21.oe1
postgresql13
SUSE:Linux Enterprise Module for Basesystem 15 SP2
From an advisory covering 2 CVEs
 before 13.2-5.6.1
13.2-5.6.1
postgresql13
SUSE:Linux Enterprise Module for Package Hub 15 SP2
From an advisory covering 2 CVEs
 before 13.2-5.6.1
13.2-5.6.1
postgresql13
SUSE:Linux Enterprise Module for Server Applications 15 SP2
From an advisory covering 2 CVEs
 before 13.2-5.6.1
13.2-5.6.1
postgresql13
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 2 CVEs
 before 13.2-3.6.1
13.2-3.6.1
postgresql13
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 2 CVEs
 before 13.2-3.6.1
13.2-3.6.1
postgresql13
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 2 CVEs
 before 13.2-3.6.1
13.2-3.6.1
postgresql13
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 13.4-1.3
13.4-1.3
postgresql14
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 14.5-2.1
14.5-2.1
postgresql15
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
 before 15.4-2.1
15.4-2.1
postgresql16
openSUSE:Tumbleweed
From an advisory covering 15 CVEs
 before 16.4-1.1
16.4-1.1
postgresql17
openSUSE:Tumbleweed
From an advisory covering 18 CVEs
 before 17.6-2.1
17.6-2.1

History

History
RecordedChangedSources
affected, facts
affectedOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-20229 is a medium vulnerability (CVSS 4.3) in Postgresql, published February 22, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in postgresql 12.6-r0.

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open