CVE-2021-32028
mediumpriority · track · 27EPSS 0.016 · 75 %ileDEEURUUSEPSS · scored 2026-10-27
A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- Mitigation SYS600cisa_csaf_ot
Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
- MitigationDMS600cisa_csaf_ot
Hitachi Energy DMS600: Update to v4.6.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4–7.7
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (33)
Products and version ranges known to be affected.
- n/a PostgreSQL≤ postgresql 13.3, postgresql 12.7, postgresql 11.12, postgresql 10.17, postgresql 9.6.22enisa_euvdEU
advisories (5)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2022-1241PostgreSQL: Mehrere SchwachstellenDeutsch2021-05-13csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen und um Informationen offenzulegen.
- WID-SEC-W-2025-0227IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2021-11-30csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um seine Privilegien zu erweitern, Administratorrechte zu erlangen, beliebigen Programmcode auszuführen, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.
- ICSA-22-111-03Hitachi Energy MicroSCADA Pro/X SYS6002022-04-21icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to eavesdrop on traffic between network source and destination, gain unauthorized access to information, or cause a denial-of-service condition.
- ICSA-22-298-04Hitachi Energy MicroSCADA X DMS6002022-10-25icsa · cisa_csaf_otUS
Successful exploitation of this vulnerabilities could allow an attacker to gain unauthorized access to information.
- BIT-postgresql-2021-320282024-03-06vendor · osvUS
A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (49)
External citations — patches, advisories, analysis.
- https://bugzilla.redhat.com/show_bug.cgi?id=1956877cnnvd
- https://packetstormsecurity.com/files/162897/Ubuntu-Security-Notice-USN-4972-1.htmlcnnvd
- https://packetstormsecurity.com/files/163054/Red-Hat-Security-Advisory-2021-2360-01.htmlcnnvd
- https://packetstormsecurity.com/files/163074/Red-Hat-Security-Advisory-2021-2375-01.htmlcnnvd
- https://packetstormsecurity.com/files/163106/Red-Hat-Security-Advisory-2021-2392-01.htmlcnnvd
- https://packetstormsecurity.com/files/169950/Gentoo-Linux-Security-Advisory-202211-04.htmlcnnvd
- https://security.gentoo.org/glsa/202211-04cnnvd
- https://security.netapp.com/advisory/ntap-20211112-0003/cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan