PT-2021-5077 · Unknown+11 · Postgresql+10
Jacob Champion
·
Published
2021-11-10
·
Updated
2026-04-03
·
CVE-2021-23214
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PostgreSQL versions prior to the fixed version
Description
The issue is related to a man-in-the-middle attack when the server is configured to use trust authentication with a clientcert requirement or to use cert authentication. This allows an attacker to inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. The vulnerability is associated with the lack of protection for the SQL query structure, which can enable a remote attacker to execute arbitrary code.
Recommendations
For versions prior to the fixed version, consider disabling the use of trust authentication with a clientcert requirement or cert authentication until a patch is available. Restrict access to the SQL query structure to minimize the risk of exploitation. Avoid using unencrypted connections to prevent man-in-the-middle attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
SQL injection
Insufficiently Protected Credentials
Missing Encryption of Sensitive Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Postgresql
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu