Vulnerability Name:

CVE-2021-3677 (CCN-221070)

Assigned:2021-08-12
Published:2021-08-12
Updated:2023-01-31
Summary:A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.
CVSS v3 Severity:6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
6.5 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
5.7 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-200
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2021-3677

Source: CCN
Type: Red Hat Bugzilla – Bug 2001857
(CVE-2021-3677) - CVE-2021-3677 postgresql: memory disclosure in certain queries

Source: secalert@redhat.com
Type: Issue Tracking, Third Party Advisory
secalert@redhat.com

Source: XF
Type: UNKNOWN
postgresql-cve20213677-info-disc(221070)

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: CCN
Type: IBM Security Bulletin 6572989 (Security Guardium)
IBM Security Guardium is affected by multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6602957 (Sterling Connect:Direct for Microsoft Windows)
IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to sensitive information disclosure due to PostgreSQL (CVE-2021-3677)

Source: CCN
Type: IBM Security Bulletin 6614725 (QRadar SIEM)
IBM QRadar SIEM includes components with multiple known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6619905 (Spectrum Copy Data Management)
Vulnerabilities in Golang Go, PostgreSQL, jQuery, and Google Gson may affect IBM Spectrum Copy Data Management

Source: CCN
Type: IBM Security Bulletin 6967285 (Spectrum Protect Plus Server)
Vulnerabilities in PostgreSQL may affect IBM Spectrum Protect Plus (CVE-2022-2625, CVE-2022-1552, CVE-2021-3677)

Source: CCN
Type: postgresql Web site
CVE-2021-3677

Source: secalert@redhat.com
Type: Vendor Advisory
secalert@redhat.com

Vulnerable Configuration:Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*
    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:ibm:qradar_security_information_and_event_manager:7.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:sterling_connect:direct:4.8:*:*:*:microsoft_windows:*:*:*
  • OR cpe:/a:ibm:sterling_connect:direct:6.0:*:*:*:microsoft_windows:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_copy_data_management:2.2.0.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7992
    P
    		blktrace-1.1.0+git.20170126-3.6.1 on GA media (Moderate)
    2023-06-20
    oval:org.opensuse.security:def:7993
    P
    		bouncycastle-1.72-150200.3.12.1 on GA media (Moderate)
    2023-06-20
    oval:org.opensuse.security:def:8058
    P
    		perl-doc-5.26.1-150300.17.11.1 on GA media (Moderate)
    2023-06-20
    oval:org.opensuse.security:def:7441
    P
    		augeas-1.12.0-150400.3.3.6 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:7485
    P
    		dracut-055+suse.360.g076f1113-150500.1.4 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:782
    P
    		Security update for libcaca (Moderate)
    2022-09-26
    oval:org.opensuse.security:def:3683
    P
    		Security update for webkit2gtk3 (Important) (in QA)
    2022-08-01
    oval:org.opensuse.security:def:95395
    P
    		Security update for python-Twisted (Important)
    2022-07-06
    oval:org.opensuse.security:def:95394
    P
    		Security update for xen (Important)
    2022-07-06
    oval:org.opensuse.security:def:3492
    P
    		fuse-2.9.3-6.3.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3493
    P
    		g3utils-1.1.36-58.6.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3447
    P
    		bubblewrap-0.3.3-1.31 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95077
    P
    		postgresql13-13.6-5.25.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94604
    P
    		libXRes1-1.2.0-1.18 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94605
    P
    		libXcursor-devel-1.1.15-1.18 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:6185
    P
    		Security update for MozillaFirefox (Important)
    2022-03-09
    oval:org.opensuse.security:def:6186
    P
    		Security update for mariadb (Important)
    2022-03-09
    oval:org.opensuse.security:def:112621
    P
    		libecpg6-13.4-1.3 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:113158
    P
    		postgresql11-11.13-1.3 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:113160
    P
    		postgresql12-12.8-1.3 on GA media (Moderate)
    2022-01-17
    oval:com.redhat.rhsa:def:20215236
    P
    		RHSA-2021:5236: postgresql:13 security update (Moderate)
    2021-12-21
    oval:com.redhat.rhsa:def:20215235
    P
    		RHSA-2021:5235: postgresql:12 security update (Moderate)
    2021-12-21
    oval:org.opensuse.security:def:106104
    P
    		libecpg6-13.4-1.3 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:106584
    P
    		postgresql11-11.13-1.3 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:106585
    P
    		postgresql12-12.8-1.3 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:68530
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:93761
    P
    		 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:109245
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:64582
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:102064
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:76004
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:102763
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:96074
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:118526
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:5846
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:69147
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:67274
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:1484
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:107984
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:100661
    P
    		 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:73704
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:102107
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:6481
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:117498
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:68574
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:93975
    P
    		 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:109429
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:64772
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:102211
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:76342
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:102764
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:5847
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:67275
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:1635
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:108773
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:101513
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:111730
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:73894
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:102108
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:95866
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:118330
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:69081
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:94187
    P
    		 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:109430
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:66935
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:76343
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:99996
    P
    		 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:101317
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:67570
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:108774
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:64581
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:101879
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:111731
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:76003
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:102579
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:96073
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:118525
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:69082
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:94398
    P
    		 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:66936
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:1219
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:107983
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:100332
    P
    		 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:73703
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:101318
    P
    		Security update for postgresql12 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:117497
    P
    		Security update for postgresql13 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:34539
    P
    		Security update for postgresql13 (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:26128
    P
    		Security update for postgresql13 (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:60361
    P
    		Security update for postgresql12 (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:87467
    P
    		Security update for postgresql13 (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:5114
    P
    		Security update for postgresql12 (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:33003
    P
    		Security update for postgresql13 (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:60362
    P
    		Security update for postgresql13 (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:5115
    P
    		Security update for postgresql13 (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:34538
    P
    		Security update for postgresql12 (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:26127
    P
    		Security update for postgresql12 (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:58826
    P
    		Security update for postgresql13 (Moderate)
    2021-09-16
    BACK
    ibm qradar security information and event manager 7.3
    ibm sterling connect:direct 4.8
    ibm sterling connect:direct 6.0
    ibm security guardium 11.0
    ibm security guardium 11.1
    ibm qradar security information and event manager 7.4 -
    ibm security guardium 11.2
    ibm security guardium 11.3
    ibm security guardium 11.4
    ibm spectrum copy data management 2.2.0.0