FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

nothing found there

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
76e0bb86-b4cb-11eb-b9c9-6cc21735f730PostgreSQL -- Memory disclosure in partitioned-table UPDATE ... RETURNING

The PostgreSQL project reports:

Using an UPDATE ... RETURNING on a purpose-crafted partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and complete this attack at will. A user lacking the CREATE and TEMPORARY privileges on all databases and the CREATE privilege on all schemas typically cannot use this attack at will.


Discovery 2021-05-13
Entry 2021-05-14
postgresql13-server
lt 13.3

postgresql12-server
lt 12.7

postgresql11-server
lt 11.12

https://www.postgresql.org/support/security/CVE-2021-32029/
2ccd71bd-426b-11ec-87db-6cc21735f730PostgreSQL -- Possible man-in-the-middle attacks

The PostgreSQL Project reports:

CVE-2021-23214: A man-in-the-middle with the ability to inject data into the TCP connection could stuff some cleartext data into the start of a supposedly encryption-protected database session. This could be abused to send faked SQL commands to the server, although that would only work if the server did not demand any authentication data. (However, a server relying on SSL certificate authentication might well not do so.)

CVE-2021-23222: A man-in-the-middle with the ability to inject data into the TCP connection could stuff some cleartext data into the start of a supposedly encryption-protected database session. This could probably be abused to inject faked responses to the client's first few queries, although other details of libpq's behavior make that harder than it sounds. A different line of attack is to exfiltrate the client's password, or other sensitive data that might be sent early in the session. That has been shown to be possible with a server vulnerable to CVE-2021-23214.


Discovery 2021-11-08
Entry 2021-11-10
postgresql14-server
lt 14.1

postgresql13-server
lt 13.5

postgresql12-server
lt 12.9

postgresql11-server
lt 11.14

postgresql10-server
lt 10.19

postgresql96-server
lt 9.6.24

CVE-2021-23214
CVE-2021-23222
62da9702-b4cc-11eb-b9c9-6cc21735f730PostgreSQL server -- two security issues

The PostgreSQL project reports:

Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE

Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and complete this attack at will. A user lacking the CREATE and TEMPORARY privileges on all databases and the CREATE privilege on all schemas cannot use this attack at will..

Buffer overrun from integer overflow in array subscripting calculations

While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory.


Discovery 2021-05-13
Entry 2021-05-14
postgresql13-server
lt 13.3

postgresql12-server
lt 12.7

postgresql11-server
lt 11.12

postgresql10-server
lt 10.17

postgresql96-server
lt 9.6.22

https://www.postgresql.org/support/security/CVE-2021-32027/
https://www.postgresql.org/support/security/CVE-2021-32028/
b471130b-fb86-11eb-87db-6cc21735f730PostgreSQL server -- Memory disclosure in certain queries

The PostgreSQL Project reports:

A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.


Discovery 2021-08-12
Entry 2021-08-12
postgresql13-server
lt 13.4

postgresql12-server
lt 12.8

postgresql11-server
lt 11.13

CVE-2021-3677
https://www.postgresql.org/support/security/CVE-2021-3677/