CVE-2021-3393

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-01 · updated 2026-06-17
Weakness: CWE-209

Description

An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.

Affected products

PostgreSQL: before 11.11; from 12.0 before 12.6; from 13.0 before 13.2 — fixed in 11.11, 12.6, 13.2
Red Hat Enterprise Linux: 8.0
RedHat Software Collections: all versions

How to fix

Upgrade to a fixed version: PostgreSQL 11.11, 12.6, 13.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3393 or the next vulnerability affects your stack