A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.
Se ha encontrado un fallo en postgresql. Usando un comando INSERT ... ON CONFLICT ... DO UPDATE en una tabla diseñada a tal efecto, un usuario autenticado de la base de datos podía leer bytes arbitrarios de la memoria del servidor. La mayor amenaza de esta vulnerabilidad es la confidencialidad de los datos
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | NONE |
| Availability Impact | NONE |
AV:N/AC:L/Au:S/C:P/I:N/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | SINGLE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | NONE |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-200
|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| postgresql | postgresql | * | <built-in method update of dict object at 0x72a9cc660540> | Application |
| postgresql | postgresql | * | <built-in method update of dict object at 0x72a9cc662000> | Application |
| postgresql | postgresql | * | <built-in method update of dict object at 0x72a9b0b3bf40> | Application |
| postgresql | postgresql | * | <built-in method update of dict object at 0x72a9cc6d8480> | Application |
| postgresql | postgresql | * | <built-in method update of dict object at 0x72a9cc660600> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* |