30th September 2021: PostgreSQL 14 Released!

CVE-2021-3393

Partition constraint violation errors leak values of denied columns

A user having an UPDATE privilege on a partitioned table but lacking the SELECT privilege on some column may be able to acquire denied-column values from an error message. This is similar to CVE-2014-8161, but the conditions to exploit are more rare.

The PostgreSQL project thanks Heikki Linnakangas for reporting this problem.

Version Information

Affected Version Fixed In Fix Published
13 13.2 2021-02-11
12 12.6 2021-02-11
11 11.11 2021-02-11

For more information about PostgreSQL versioning, please visit the versioning page.

CVSS 3.0

Overall Score 3.1
Component core server
Vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Reporting Security Vulnerabilities

If you wish to report a new security vulnerability in PostgreSQL, please send an email to security@postgresql.org.

For reporting non-security bugs, please see the Report a Bug page.