PT-2023-18436 · Pgpool-Ii+1 · Pgpool-Ii+1
Published
2023-01-23
·
Updated
2025-03-28
·
CVE-2023-22332
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Pgpool-II versions 3.3.0 through 4.4.1
Pgpool-II versions 3.4.0 through 4.4.1
Pgpool-II versions 3.5.0 through 4.4.1
Pgpool-II versions 3.6.0 through 4.4.1
Pgpool-II versions 3.7.0 through 4.4.1
Pgpool-II versions 4.0.0 through 4.0.21
Pgpool-II versions 4.1.0 through 4.1.14
Pgpool-II versions 4.2.0 through 4.2.11
Pgpool-II versions 4.3.0 through 4.3.4
Pgpool-II versions 4.4.0 through 4.4.1
Description
A specific database user's authentication information may be obtained by another database user. As a result, the information stored in the database may be altered and/or the database may be suspended by a remote attacker who successfully logged in the product with the obtained credentials.
Recommendations
For Pgpool-II versions 3.3.0 through 4.4.1, restrict access to the database to minimize the risk of exploitation.
For Pgpool-II versions 4.0.0 through 4.0.21, consider disabling the vulnerable authentication mechanism until a patch is available.
For Pgpool-II versions 4.1.0 through 4.1.14, avoid using the vulnerable database user authentication until the issue is resolved.
For Pgpool-II versions 4.2.0 through 4.2.11, restrict access to the vulnerable database modules to minimize the risk of exploitation.
For Pgpool-II versions 4.3.0 through 4.3.4, consider temporarily disabling the vulnerable database functionality until a patch is available.
For Pgpool-II versions 4.4.0 through 4.4.1, restrict access to the database to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Cleartext Storage of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Pgpool-Ii