The vulnerability of the PostgreSQL database management system, related to security mechanism errors, allows a perpetrator to obtain column values from error messages (without the privilege for SELECT).

🗓️ 16 Feb 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

PostgreSQL errors disclose column values from error messages without SELECT privilege.

Reporter	Title	Published	Views	Family All 122
Gitee	Exploit for Generation of Error Message Containing Sensitive Information in Postgresql	14 Sep 202518:05	–	gitee
Gitee	Exploit for Generation of Error Message Containing Sensitive Information in Postgresql	13 Dec 202122:13	–	gitee
ALT Linux	Security fix for the ALT Linux 10 package postgresql13 version 13.2-alt1	11 Feb 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql15 version 13.2-alt1	11 Feb 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 8 package postgresql12 version 12.6-alt0.M80P.1	17 Mar 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql15-1C version 12.5-alt4	11 Feb 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package postgresql12-1C version 12.5-alt4	11 Feb 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql14 version 13.2-alt1	11 Feb 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package postgresql12 version 12.6-alt0.M90P.1	19 Feb 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql12 version 12.6-alt1	11 Feb 202100:00	–	altlinux

Vulners

Node

postgresql postgresqlRange≤13.1

OR

postgres_professional postgres_pro_certifiedRange<11.11.1

OR

red_hat red_hat_enterprise_linuxMatch8

Source	Link
postgresql	www.postgresql.org/about/news/postgresql-132-126-1111-1016-9621-and-9525-released-2165/
access	www.access.redhat.com/security/cve/cve-2021-3393
security-tracker	www.security-tracker.debian.org/tracker/CVE-2021-3393
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2021021136
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.3/
postgrespro	www.postgrespro.ru/products/postgrespro/certified
altsp	www.altsp.su/obnovleniya-bezopasnosti/
abf	www.abf.rosa.ru/advisories/ROSA-SA-2024-2449
web	www.web.nvd.nist.gov/view/vuln/detail

05 Mar 2025 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 22.1

CVSS 33.1

EPSS0.01187

PostgreSQL security mechanism errors read column values error messages