CVE-2021-32027 Integer overflow in postgresql

What is CVE-2021-32027?

CVE-2021-32027 is a high-severity vulnerability in Postgresql Postgresql, published on 1 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Weakness: CWE-190

Which versions are affected by CVE-2021-32027?

1 open source package ship an affected version, including postgresql. It affects 4 products.

Products include Postgresql Postgresql, Redhat Enterprise Linux, Redhat Jboss Enterprise Application Platform, Redhat Software Collections.

How do I fix CVE-2021-32027?

Upgrade postgresql to a fixed version for your release line: 9.6.22, 10.17.0, 11.12.0 or 12.7.0.

Is CVE-2021-32027 being exploited?

There is no known exploitation of CVE-2021-32027 in the wild and no public exploit code.

Other vulnerabilities in Postgresql Postgresql

• CVE-2013-1902 Information disclosure in n/a Critical 10.0
• CVE-2013-1903 Information disclosure in n/a Critical 10.0
• CVE-2007-3279 Privilege escalation in n/a Critical 10.0
• CVE-2002-1399 Integer overflow in n/a Critical 10.0
• CVE-2016-3065 Information disclosure in n/a Critical 9.1

All Postgresql Postgresql vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2021-32027, BIT-postgresql-2021-32027, CLEANSTART-2026-VG30950, CLSA-2022-1665428667, DEBIAN-CVE-2021-32027, ECHO-a2f0-e2f0-ee68 and 4 more.