postgresql: memory disclosure in certain queries

🗓️ 07 Jun 2022 15:25:54Reported by RedHatType

PostgreSQL memory disclosure lets authenticated users read arbitrary server memory via crafted queries; max_worker_processes=0 makes it infeasible.

Reporter	Title	Published	Views	Family All 157
ALT Linux	Security fix for the ALT Linux 8 package postgresql12 version 12.9-alt0.M80P.1	21 Dec 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql15-1C version 12.7-alt2	11 Aug 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql15 version 13.4-alt1	11 Aug 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql12 version 12.8-alt1	16 Aug 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 8 package postgresql11-1C version 11.12-alt0.M80P.2	21 Dec 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package postgresql12 version 12.8-alt0.M90P.1	23 Aug 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package postgresql12-1C version 12.7-alt0.M90P.2	23 Aug 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql13 version 13.4-alt1	16 Aug 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 8 package postgresql11 version 11.14-alt0.M80P.1	21 Dec 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql14 version 13.4-alt1	11 Aug 202100:00	–	altlinux

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	x86_64	rhvm-appliance	2:4.5-20220603.1.el8ev	rhvm-appliance-2:4.5-20220603.1.el8ev.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-3677
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-3677
cve	www.cve.org/CVERecord
postgresql	www.postgresql.org/support/security/CVE-2021-3677/

28 Jun 2026 12:09Current

7.1High risk

Vulners AI Score7.1

CVSS 24

CVSS 3.16.5

EPSS0.0142