SB2021022002 - Arch Linux update for postgresql

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Information Exposure Through an Error Message (CVE-ID: CVE-2014-8161)

The vulnerability allows a remote authenticated user to gain access to sensitive information.

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.

2) Security restrictions bypass (CVE-ID: CVE-2021-20229)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to application does not properly impose security restrictions. A user having a SELECT privilege on an individual column can craft a special query that returns all columns of the table. Additionally, a stored view that uses column-level privileges will have incomplete column-usage bitmaps. In installations that depend on column-level permissions for security, it is recommended to execute CREATE OR REPLACE on all user-defined views to force them to be re-parsed.

3) Information disclosure (CVE-ID: CVE-2021-3393)

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in the error message. A remote user having an UPDATE privilege on a partitioned table but lacking the SELECT privilege on some column may be able to acquire denied-column values from an error message. This vulnerability is similar to #VU30418.

Remediation

Install update from vendor's website.

References

• https://security.archlinux.org/advisory/ASA-202102-31