LiveActive security incident?Get immediate response
CVE Record

CVE-2021-33204: In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code executio...

In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achieved via SECURITY DEFINER functions because an explicit search_path is not set.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2021-33204 affects the pg_partman PostgreSQL extension before 4.5.1. A database extension function could run with elevated privileges while using an unsafe object lookup path, creating a path to arbitrary code execution. Business impact depends on where pg_partman is installed and who can interact with the affected database objects.

Executive priority

Prioritize remediation where pg_partman is present on important PostgreSQL systems, especially multi-user databases. The vulnerability class can cross privilege boundaries, but urgency should be based on confirmed installation and vendor exposure because scoring and exploitation evidence are absent.

Technical view

The issue is unsafe SECURITY DEFINER usage in pg_partman before 4.5.1 because affected functions did not explicitly set search_path. That can allow attacker-controlled object resolution during privileged function execution. The supplied sources identify the fix through the 4.5.1 comparison and commit; no CVSS score or CWE is provided.

Likely exposure

Exposure is most likely in PostgreSQL deployments that installed pg_partman versions before 4.5.1. The provided affected-product metadata is incomplete, so teams should inventory extension versions directly and review NetApp applicability if they use NetApp products or services referencing this advisory.

Exploitation context

The CVE source says arbitrary code execution is possible. The bundle does not cite public exploitation, and KEV is false, so active exploitation is not established from the provided evidence.

Researcher notes

Primary evidence is the CVE description and upstream fix references. The key behavior is SECURITY DEFINER execution without explicit search_path. Source data lacks CVSS, CWE mapping, detailed preconditions, and affected vendor/product enumeration beyond pg_partman before 4.5.1.

Mitigation direction

  • Upgrade pg_partman to version 4.5.1 or later.
  • Review the upstream commit and version comparison for the security-relevant change.
  • Check NetApp advisory applicability for any NetApp-managed or bundled PostgreSQL environments.
  • If upgrade timing is constrained, follow vendor guidance for interim risk reduction.

Validation and detection

  • Inventory PostgreSQL instances for installed pg_partman extension versions.
  • Confirm no production or managed database uses pg_partman before 4.5.1.
  • Review database extension deployment processes for outdated pg_partman packages.
  • Track remediation evidence against the upstream 4.5.1 fix reference.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-33204 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.