Description
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a postgresql
Affects v9.6 to v14affected
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2022666 ↗
- https://www.postgresql.org/support/security/CVE-2021-23214/ ↗
- https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commit%3Bh=28e24125541545483093819efae9bca603441951 ↗
- https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951 ↗
- https://security.gentoo.org/glsa/202211-04 ↗