CVE-2021-3677

Katalog CVE

CVSS 6.5 · Medium EPSS 1,4%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada postgresql, redhat virtualization +5 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.

Rincian

Terbit di NVD

2 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.postgresql.org/support/security/CVE-2021-3677/ advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2001857 issue tracking · advisory pihak ketiga
• https://security.gentoo.org/glsa/202211-04 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220407-0008/ advisory pihak ketiga