PT-2023-23170 · Unknown · Postgresnio

Fabianfett · Published 2023-05-09 · Updated 2023-05-16 · CVE-2023-31136

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PostgresNIO versions prior to 1.14.2

Description The issue affects users of PostgresNIO who connect to servers with TLS enabled, allowing a man-in-the-middle attacker to inject false responses to the client's first few queries despite the use of TLS certificate verification and encryption.

Recommendations For PostgresNIO versions prior to 1.14.2, update to version 1.14.2 or later to resolve the issue. As a temporary workaround, consider disabling TLS connections until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2023-31136

GHSA-467W-RRQC-395F

GHSA-735F-7QX4-JQQ5

GHSA-9CFH-VX93-84VV

Affected Products

Postgresnio

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31136.json · Exploit
• https://github.com/apple/swift-nio/pull/2419 · Patch
• https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7 · Patch
• https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31136 · Security Note
• https://osv.dev/vulnerability/GHSA-9cfh-vx93-84vv · Vendor Advisory
• https://github.com/vapor/postgres-nio · Note
• https://github.com/vapor/postgres-nio/releases/tag/1.14.2 · Note
• https://postgresql.org/support/security/CVE-2021-23214 · Note
• https://postgresql.org/support/security/CVE-2021-23222 · Note
• https://github.com/advisories/GHSA-467w-rrqc-395f · Note
• https://github.com/advisories/GHSA-735f-7qx4-jqq5 · Note
• https://t.me/cibsecurity/63623 · Telegram Post