SB2021052628 - Gentoo update for PostgreSQL

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Security restrictions bypass (CVE-ID: CVE-2021-20229)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to application does not properly impose security restrictions. A user having a SELECT privilege on an individual column can craft a special query that returns all columns of the table. Additionally, a stored view that uses column-level privileges will have incomplete column-usage bitmaps. In installations that depend on column-level permissions for security, it is recommended to execute CREATE OR REPLACE on all user-defined views to force them to be re-parsed.

2) Information disclosure (CVE-ID: CVE-2021-3393)

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in the error message. A remote user having an UPDATE privilege on a partitioned table but lacking the SELECT privilege on some column may be able to acquire denied-column values from an error message. This vulnerability is similar to #VU30418.

Remediation

Install update from vendor's website.

References

• https://security.gentoo.org/
• https://security.gentoo.org/glsa/202105-32