Memory Exposure Vulnerability in PostgreSQL by PostgreSQL Global Development Group

CVE-2021-3677

Summary

A vulnerability in PostgreSQL allows authenticated users to execute specially crafted queries that can read arbitrary bytes from the server's memory. This flaw can be exploited without the need for additional privileges, making it a significant risk in default configurations. The severity of the attack can vary depending on the server settings, specifically if 'max_worker_processes' is set to 0, making some known exploit variants infeasible. However, there may exist undiscovered attack variants that are not limited by this server configuration. Database administrators should assess their systems to ensure they are protected against this memory exposure risk.

References