CVE-2021-23214
High
Description
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Postgresql
PublishedMar 4, 2022
First seenMar 4, 2022
Weakness typeCWE-89SQL injection
How to fix
Update
- postgresql postgresql9.6.24, 10.19, 11.14, 12.9, 13.5 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| postgresql postgresql | v < 9.6.24, 10.0 ≤ v < 10.19, 11.0 ≤ v < 11.14, 12.0 ≤ v < 12.9, 13.0 ≤ v < 13.5, 14.0 | 9.6.24, 10.19, 11.14, 12.9, 13.5 |
| fedoraproject fedora | 34, 35 | — |
| redhat software_collections | 1.0 | — |
| redhat enterprise_linux | 8.0 | — |
| redhat enterprise_linux_for_ibm_z_systems | 8.0 | — |
| redhat enterprise_linux_for_power_little_endian | 8.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.