CVE-2021-3677: Fedoraproject Fedora

Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days.

A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.

Affected products

• Fedoraproject Fedora: version 34 only
• PostgreSQL PostgreSQL: from 11.0, before 11.13 (fixed in 11.13); from 12.0, before 12.8 (fixed in 12.8); from 13.0, before 13.4 (fixed in 13.4)
• Red Hat Enterprise Linux: version 8.0 only
• Red Hat Enterprise Linux For IBM Z Systems: version 8.0 only
• Red Hat Enterprise Linux For Power Little Endian: version 8.0 only
• Red Hat Software Collections: version 1.0 only
• Red Hat Virtualization: version 4.0 only

Published 2022-03-02. Last modified 2026-06-17.