CVE-2021-3515

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-01 · updated 2026-06-17
Weakness: CWE-77

Description

A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. An attacker with CREATEDB privileges on a PostgreSQL server can craft a database name that allows execution of shell commands as the postgresql user when calling pglogical.create_subscription().

Affected products

pglogical: before 2.3.4; from 3.0.0 before 3.6.26 — fixed in 2.3.4, 3.6.26

How to fix

Upgrade to a fixed version: pglogical 2.3.4, 3.6.26. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1954112
https://bugzilla.redhat.com/show_bug.cgi?id=1954112

Get alerted when CVE-2021-3515 or the next vulnerability affects your stack