Lucene search

FreeBSD58B22F3A-BC71-11EB-B9C9-6CC21735F730

HistoryMay 21, 2021 - 12:00 a.m.

PG Partition Manager -- arbitrary code execution

2021-05-2100:00:00

vuxml.freebsd.org

pg partition manager

arbitrary code execution

security issue

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.005

Percentile

77.0%

JSON

PG Partition Manager reports:

    In the pg_partman (aka PG Partition Manager) extension before 4.5.1
    for PostgreSQL, arbitrary code execution can be achieved via
    SECURITY DEFINER functions because an explicit search_path is not
    set.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchpg_partman< 4.5.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	pg_partman	< 4.5.1	UNKNOWN

References

nvd.nist.gov/vuln/detail/CVE-2021-33204

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.005

Percentile

77.0%

JSON

Related for 58B22F3A-BC71-11EB-B9C9-6CC21735F730