Vulnerability Description
A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Postgresql | Postgresql | >= 9.6.0, < 9.6.22 |
| Redhat | Jboss Enterprise Application Platform | 7.0.0 |
| Redhat | Software Collections | - |
| Redhat | Enterprise Linux | 7.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1956876Issue TrackingPatchThird Party Advisory
- https://security.gentoo.org/glsa/202211-04Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210713-0004/Third Party Advisory
- https://www.postgresql.org/support/security/CVE-2021-32027/Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1956876Issue TrackingPatchThird Party Advisory
- https://security.gentoo.org/glsa/202211-04Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210713-0004/Third Party Advisory
- https://www.postgresql.org/support/security/CVE-2021-32027/Vendor Advisory
FAQ
What is CVE-2021-32027?
CVE-2021-32027 is a vulnerability with a CVSS score of 8.8 (HIGH). A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated dat...
How severe is CVE-2021-32027?
CVE-2021-32027 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-32027?
Check the references section above for vendor advisories and patch information. Affected products include: Postgresql Postgresql, Redhat Jboss Enterprise Application Platform, Redhat Software Collections, Redhat Enterprise Linux.