CVE-2021-3515

MEDIUM 6.7CVE-2021-3515 · Published 01/06/2021 · updated 17/06/2026

In short

CVE-2021-3515 is a MEDIUM (CVSS 6.7) vulnerability affecting pglogical (2ndquadrant).
Chance of exploitation in the next 30 days (EPSS): 0.46%, higher than 40.0% of all vulnerabilities.
Fix: update to 3.6.26, 2.3.4 or later.

Package	Affected versions	Patched versions
pglogical 2ndquadrant	`≥ 3.0.0, < 3.6.26< 2.3.4`	`3.6.262.3.4`

Description

A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. An attacker with CREATEDB privileges on a PostgreSQL server can craft a database name that allows execution of shell commands as the postgresql user when calling pglogical.create_subscription().

References

bugzilla.redhat.com/show_bug.cgi · Issue Tracking

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free