CVE-2021-20229

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	PostgreSQL	postgresql 13.2, postgresql 12.6, postgresql 11.11, postgresql 10.16, postgresql 9.6.21, postgresql 9.5.25

References

https://bugzilla.redhat.com/show_bug.cgi?id=1925296Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202105-32Third Party Advisory
https://security.netapp.com/advisory/ntap-20210326-0005/Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1925296Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202105-32Third Party Advisory
https://security.netapp.com/advisory/ntap-20210326-0005/Third Party Advisory

Timeline

Published: Feb 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-20234.7Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: APIs). Supported versions that are affected are 12 CVE-2021-202307.5A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and ve CVE-2021-202319.8A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequence CVE-2021-202329.8A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other CVE-2021-202338.2A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assum CVE-2021-202346.5An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue CVE-2021-202358.1There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocator could have its size CVE-2021-202369.8A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the CVE-2021-202377.5An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3. This flaw allows a remo CVE-2021-202383.7It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from cl CVE-2021-202393.3A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to lea CVE-2021-20246.5Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 an