CVE-2021-3935 — SQL Injection in Pgbouncer

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	pgbouncer	< pgbouncer 1.16.1-1 (bookworm)	pgbouncer 1.16.1-1 (bookworm)
fedoraproject	fedora	—	—
msrc	cm1_pgbouncer_1.16.1-1_on_cbl_mariner_1.0	—	—
pgbouncer	pgbouncer	< 1.16.1	1.16.1
pgbouncer	pgbouncer	—	—
pgbouncer	pgbouncer	>= 0 < 1.15.0-1+deb11u1	1.15.0-1+deb11u1
pgbouncer	pgbouncer	>= 0 < 1.16.1-1	1.16.1-1
pgbouncer	pgbouncer	>= 0 < 1.16.1-1	1.16.1-1
pgbouncer	pgbouncer	>= 0 < 1.16.1-1	1.16.1-1
redhat	enterprise_linux	—	—

GHSA

GHSA-jh4v-gqwq-hfrr: When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first es

ghsa_unreviewed·2022-05-24

CVE-2021-3935 [HIGH] CWE-295 GHSA-jh4v-gqwq-hfrr: When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first es When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1.

OSV

CVE-2021-3935: When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first es

osv·2021-11-22·CVSS 8.1

CVE-2021-3935 [HIGH] CVE-2021-3935: When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first es When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1.

Microsoft

When PgBouncer is configured to use "cert" authentication a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established despite the use of TLS certificate verifi

vendor_msrc·2021-11-09·CVSS 8.1

CVE-2021-3935 [HIGH] CWE-295 When PgBouncer is configured to use "cert" authentication a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established despite the use of TLS certificate verifi When PgBouncer is configured to use "cert" authentication a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1. FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more inf

Debian

CVE-2021-3935: pgbouncer - When PgBouncer is configured to use "cert" authentication, a man-in-the-middle a...

vendor_debian·2021·CVSS 8.1

CVE-2021-3935 [HIGH] CVE-2021-3935: pgbouncer - When PgBouncer is configured to use "cert" authentication, a man-in-the-middle a... When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1. Scope: local bookworm: resolved (fixed in 1.16.1-1) bullseye: resolved (fixed in 1.15.0-1+deb11u1) forky: resolved (fixed in 1.16.1-1) sid: resolved (fixed in 1.16.1-1) trixie: resolved (fixed in 1.16.1-1)

CVE-2021-3935: When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first…

Affected

CVSS provenance