CVE-2021-23214
published 2022-03-04CVE-2021-23214: When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject…
high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | postgresql-13 | < postgresql-13 13.5-0+deb11u1 (bullseye) | postgresql-13 13.5-0+deb11u1 (bullseye) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| github.com | vapor_postgres-nio | >= 0 < 1.14.2 | 1.14.2 |
| msrc | cbl2_postgresql_14.2-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_postgresql_12.12-1_on_cbl_mariner_1.0 | — | — |
| msrc | cm1_postgresql_12.7-2_on_cbl_mariner_1.0 | — | — |
| odyssey_project | odyssey | — | — |
| postgresql | postgresql | < 9.6.24 | 9.6.24 |
| postgresql | postgresql | — | — |
| postgresql | postgresql | >= 10.0 < 10.19 | 10.19 |
| postgresql | postgresql | >= 11.0 < 11.14 | 11.14 |
| postgresql | postgresql | >= 12.0 < 12.9 | 12.9 |
| postgresql | postgresql | >= 13.0 < 13.5 | 13.5 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_for_ibm_z_systems | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
| redhat | software_collections | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa8.1HIGH
osv8.1HIGH
Ubuntu
PostgreSQL vulnerabilities
vendor_ubuntu·2022-09-28·CVSS 8.1
CVE-2021-23214 [HIGH] PostgreSQL vulnerabilities
Title: PostgreSQL vulnerabilities
Summary: Several security issues were fixed in PostgreSQL.
Jacob Champion discovered that PostgreSQL incorrectly handled SSL
certificate verification and encryption. A remote attacker could possibly
use this issue to inject arbitrary SQL queries when a connection is first
established. (CVE-2021-23214)
Tom Lane discovered that PostgreSQL incorrect handled certain array
subscripting calculations. An authenticated attacker could possibly use
this issue to overwrite server memory and escalate privileges.
(CVE-2021-32027)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication a man-in-the-middle attacker can inject arbitrary
vendor_msrc·2022-08-09·CVSS 8.1
CVE-2021-43766 [HIGH] CWE-295 Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication a man-in-the-middle attacker can inject arbitrary
Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established despite the use of SSL certificate verification and encryption. This is similar to CVE-2021-23214 for PostgreSQL.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work wh
Microsoft
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is
vendor_msrc·2022-03-08·CVSS 8.1
CVE-2021-23214 [HIGH] CWE-89 When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established despite the use of SSL certificate verification and encryption.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for mo
Ubuntu
PostgreSQL vulnerabilities
vendor_ubuntu·2021-11-11
CVE-2021-23222 PostgreSQL vulnerabilities
Title: PostgreSQL vulnerabilities
Summary: PostgreSQL could allow unintended access to network services.
Jacob Champion discovered that PostgreSQL incorrectly handled SSL
certificate verification and encryption. A remote attacker could possibly
use this issue to inject arbitrary SQL queries when a connection is first
established.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.
Red Hat
postgresql: server processes unencrypted bytes from man-in-the-middle
vendor_redhat·2021-11-11·CVSS 8.1
CVE-2021-23214 [HIGH] CWE-89 postgresql: server processes unencrypted bytes from man-in-the-middle
postgresql: server processes unencrypted bytes from man-in-the-middle
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.
It was found that a PostgreSQL server could accept plain text data during the establishment of an SSL connection. When a user is requesting a certificate based authentication, an active Person in the Middle could use this flaw in order to inject arbitrary SQL commands.
Statement: In Red Hat Virtualization the manager appliance uses a vulnerable version of postgresql. Once a fix has been shipped for RHEL 8 the appliance can consume the fix
Debian
CVE-2021-23214: postgresql-13 - When the server is configured to use trust authentication with a clientcert requ...
vendor_debian·2021·CVSS 8.1
CVE-2021-23214 [HIGH] CVE-2021-23214: postgresql-13 - When the server is configured to use trust authentication with a clientcert requ...
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.
Scope: local
bullseye: resolved (fixed in 13.5-0+deb11u1)
GHSA
PostgresNIO processes unencrypted bytes from man-in-the-middle
ghsa·2023-05-10·CVSS 8.1
CVE-2023-31136 [HIGH] CWE-522 PostgresNIO processes unencrypted bytes from man-in-the-middle
PostgresNIO processes unencrypted bytes from man-in-the-middle
### Impact
Any user of PostgresNIO connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption.
_The remaining text in this section is quoted verbatim from [PostgreSQL's CVE-2021-23222 advisory](https://www.postgresql.org/support/security/CVE-2021-23222/):_
> If more preconditions hold, the attacker can exfiltrate the client's password or other confidential data that might be transmitted early in a session. The attacker must have a way to trick the client's intended server into making the confidential data accessible to the attacker. A known implementation having that property i
OSV
PostgresNIO processes unencrypted bytes from man-in-the-middle
osv·2023-05-10·CVSS 8.1
CVE-2023-31136 [HIGH] PostgresNIO processes unencrypted bytes from man-in-the-middle
PostgresNIO processes unencrypted bytes from man-in-the-middle
### Impact
Any user of PostgresNIO connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption.
_The remaining text in this section is quoted verbatim from [PostgreSQL's CVE-2021-23222 advisory](https://www.postgresql.org/support/security/CVE-2021-23222/):_
> If more preconditions hold, the attacker can exfiltrate the client's password or other confidential data that might be transmitted early in a session. The attacker must have a way to trick the client's intended server into making the confidential data accessible to the attacker. A known implementation having that property i
OSV
postgresql-9.5 vulnerabilities
osv·2022-09-28·CVSS 8.1
CVE-2021-23214 [HIGH] postgresql-9.5 vulnerabilities
postgresql-9.5 vulnerabilities
Jacob Champion discovered that PostgreSQL incorrectly handled SSL
certificate verification and encryption. A remote attacker could possibly
use this issue to inject arbitrary SQL queries when a connection is first
established. (CVE-2021-23214)
Tom Lane discovered that PostgreSQL incorrect handled certain array
subscripting calculations. An authenticated attacker could possibly use
this issue to overwrite server memory and escalate privileges.
(CVE-2021-32027)
GHSA
GHSA-946v-j885-6j5f: Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication,
ghsa_unreviewed·2022-08-26·CVSS 8.1
CVE-2021-43766 [HIGH] CWE-295 GHSA-946v-j885-6j5f: Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication,
Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. This is similar to CVE-2021-23214 for PostgreSQL.
GHSA
GHSA-467w-rrqc-395f: When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker ca
ghsa_unreviewed·2022-03-05
CVE-2021-23214 [HIGH] CWE-89 GHSA-467w-rrqc-395f: When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker ca
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.
OSV
CVE-2021-23214: When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker ca
osv·2022-03-04·CVSS 8.1
CVE-2021-23214 [HIGH] CVE-2021-23214: When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker ca
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=2022666https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commit%3Bh=28e24125541545483093819efae9bca603441951https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951https://security.gentoo.org/glsa/202211-04https://www.postgresql.org/support/security/CVE-2021-23214/https://bugzilla.redhat.com/show_bug.cgi?id=2022666https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commit%3Bh=28e24125541545483093819efae9bca603441951https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951https://security.gentoo.org/glsa/202211-04https://www.postgresql.org/support/security/CVE-2021-23214/
2022-03-04
Published