CVE-2021-3515

MEDIO 6.7CVE-2021-3515 · Published 01/06/2021 · updated 17/06/2026

In breve

CVE-2021-3515 è una vulnerabilità MEDIO (CVSS 6.7) che riguarda pglogical (2ndquadrant).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.46%, superiore al 40.0% delle vulnerabilità.
Correzione: aggiornare a 3.6.26, 2.3.4 o successiva.

Package	Affected versions	Patched versions
pglogical 2ndquadrant	`≥ 3.0.0, < 3.6.26< 2.3.4`	`3.6.262.3.4`

Description

A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. An attacker with CREATEDB privileges on a PostgreSQL server can craft a database name that allows execution of shell commands as the postgresql user when calling pglogical.create_subscription().

References

bugzilla.redhat.com/show_bug.cgi · Issue Tracking

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free