CVE-2021-3393: PostgreSQL

Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days.

An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.

Affected products

• PostgreSQL PostgreSQL: before 11.11 (fixed in 11.11); from 12.0, before 12.6 (fixed in 12.6); from 13.0, before 13.2 (fixed in 13.2)
• Red Hat Enterprise Linux: version 8.0 only
• Red Hat Software Collections: affected versions not specified

Published 2021-04-01. Last modified 2026-06-17.