CVE-2021-20229
A user having a SELECT privilege on an individual column can craft a special query that returns all columns of the table.
Additionally, a stored view that uses column-level privileges will have incomplete column-usage bitmaps. In installations that depend on column-level permissions for security, it is recommended to execute CREATE OR REPLACE on all user-defined views to force them to be re-parsed.
The PostgreSQL project thanks Sven Klemm for reporting this problem.
Version Information
| Affected branch | Introduced | Fixed In | Fix Published |
|---|
| 13 | — | 13.2 | 2021-02-11 |
CVSS 3.0
| Overall Score | 3.1 |
|---|
| Component | core server |
|---|
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
|---|
First published: 2021-02-11
Original security advisory · JSON · All advisories