CVE-2021-32027

A flaw was found in postgresql. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Writing arbitrary bytes to a wide area of server memory can provide a powerful primitive that could ultimately lead to remote code execution. For this reason this flaw has been rated as having a security impact of Important. The versions of postgresql as shipped with Red Hat Enterprise Linux 7, 8 and Red Hat Software Collections are all affected by this flaw. A future update may address this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.