CVE-2021-23214

CVE-2021-23214

Name

CVE-2021-23214

Description

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

NVD Severity

high

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
Patch	https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=28e24125541545483093819efae9bca603441951
Vendor Advisory	https://www.postgresql.org/support/security/CVE-2021-23214/
Patch	https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951
Issue Tracking	https://bugzilla.redhat.com/show_bug.cgi?id=2022666

Type

URI

Patch

https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=28e24125541545483093819efae9bca603441951

Vendor Advisory

https://www.postgresql.org/support/security/CVE-2021-23214/

Patch

https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=2022666

Match rules

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= None	< 9.6.24
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= 10.0	< 10.19
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= 11.0	< 11.14
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= 12.0	< 12.9
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= 13.0	< 13.5
`cpe:2.3:a:postgresql:postgresql:14.0:::::::*`	postgresql	== None	== 14.0

CPE URI

Source package

Min version

Max version