Electric Postgres Sync
Monthly
Column-value inference via observable discrepancy in Electric Postgres Sync below 1.6.10 allows authenticated remote attackers to deduce the values of columns intentionally excluded from shape responses. By crafting subset WHERE clause conditions against shape endpoints and observing whether rows are matched or returned, an attacker can systematically enumerate sensitive field data that the application's column-based access restrictions are designed to conceal. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available at version 1.6.10.
Column-value inference via observable discrepancy in Electric Postgres Sync below 1.6.10 allows authenticated remote attackers to deduce the values of columns intentionally excluded from shape responses. By crafting subset WHERE clause conditions against shape endpoints and observing whether rows are matched or returned, an attacker can systematically enumerate sensitive field data that the application's column-based access restrictions are designed to conceal. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available at version 1.6.10.