Corrective updates have been released for all supported branches of PostgreSQL: 13.4, 12.8, 11.13, 10.18, and 9.6.23. Updates for branch 9.6 will continue until November 2021, for 10 until November 2022, for 11 until November 2023, for 12 until November 2024, and for 13 until November 2025.
The new versions include 75 fixes and resolve the vulnerability CVE-2021-3677, which allows reading the contents of the server process memory through the execution of a specially crafted query. The attack can be carried out by any user with access to execute SQL queries. Only PostgreSQL branches 11, 12, and 13 are affected. Known attack vectors do not affect configurations with max_worker_processes=0, but variants that do not depend on this setting may still exist.
Source: opennet.ru
