PT-2021-19473 · Pgsync · Pgsync

Dmitry Gunchenko · Published 2021-04-27 · Updated 2021-05-04 · CVE-2021-31671

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions pgsync versions prior to 0.6.7

Description The issue concerns the mishandling of syncing the schema with the --schema-first and --schema-only options, leading to information disclosure of sensitive information. For example, the sslmode connection parameter may be lost, resulting in SSL not being used.

Recommendations For versions prior to 0.6.7, update to version 0.6.7 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the --schema-first and --schema-only options until a patch is applied. Restrict access to sensitive information to minimize the risk of exploitation.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2021-31671

GHSA-72RJ-36QC-47G7

Affected Products

Pgsync

References · 8

• 🔥 https://github.com/ankane/pgsync/issues/121 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pgsync/CVE-2021-31671.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-31671 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31671 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-72rj-36qc-47g7 · Vendor Advisory
• https://github.com/ankane/pgsync/commit/05cd18f5fc09407e4b544f2c12f819cabc50c40e · Note
• https://github.com/ankane/pgsync/blob/master/CHANGELOG.md#067-2021-04-26 · Note
• https://t.me/cvenotify/13759 · Telegram Post