CVE-2021-23214

Name
CVE-2021-23214
Description
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.
NVD Severity
high
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Patch https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=28e24125541545483093819efae9bca603441951
Vendor Advisory https://www.postgresql.org/support/security/CVE-2021-23214/
Patch https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2022666

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* postgresql >= None < 9.6.24
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* postgresql >= 10.0 < 10.19
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* postgresql >= 11.0 < 11.14
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* postgresql >= 12.0 < 12.9
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* postgresql >= 13.0 < 13.5
cpe:2.3:a:postgresql:postgresql:14.0:*:*:*:*:*:*:* postgresql == None == 14.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
postgresql 3.11-main 12.9-r0 Jakub Jirutka <jakub@jirutka.cz> fixed