Home

CVE-2021-23214

Description

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

Risk Information

Base Score
8.1
MODERATE
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.326

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2021-23222 Announcement,CVE-2021-23214 Announcement are fixed in Postgresql 14.1Windows
Vulnerabilities CVE-2021-23222,CVE-2021-23214 are fixed in PostgreSQL 14.1Windows
Vulnerabilities CVE-2021-23222,CVE-2021-23214 are fixed in PostgreSQL 13.5Windows
Vulnerabilities CVE-2021-23222,CVE-2021-23214 are fixed in PostgreSQL 12.9Windows
Vulnerabilities CVE-2021-23222,CVE-2021-23214 are fixed in PostgreSQL 11.14Windows
Vulnerabilities CVE-2021-23222,CVE-2021-23214 are fixed in PostgreSQL 10.19Windows
Vulnerabilities CVE-2021-23222,CVE-2021-23214 are fixed in PostgreSQL 9.6.24Windows
postgresql-11 security update(DSA-5006-1) postgresql-11_11.14-0+deb10u1_i386.debLinux
postgresql-11 security update(DSA-5006-1) postgresql-11_11.14-0+deb10u1_amd64.debLinux
Object-relational SQL database (USN-5145-1) postgresql-10_10.22-0ubuntu0.18.04.1_i386.debLinux
Object-relational SQL database (USN-5145-1) postgresql-10_10.22-0ubuntu0.18.04.1_amd64.debLinux
Object-relational SQL database (USN-5145-1) postgresql-12_12.12-0ubuntu0.20.04.1_i386.debLinux
Object-relational SQL database (USN-5145-1) postgresql-12_12.12-0ubuntu0.20.04.1_amd64.debLinux
Object-relational SQL database (USN-5145-1) postgresql-13_13.5-0ubuntu0.21.04.1_i386.debLinux
Object-relational SQL database (USN-5145-1) postgresql-13_13.5-0ubuntu0.21.04.1_amd64.debLinux
Object-relational SQL database (USN-5145-1) postgresql-13_13.7-0ubuntu0.21.10.1_i386.debLinux
Object-relational SQL database (USN-5145-1) postgresql-13_13.7-0ubuntu0.21.10.1_amd64.debLinux
SUSE-SU-2021:3761-1(SUSE Linux Enterprise Server 12-SP5 ) postgresql10-10.19-4.22.1.x86_64.rpmLinux
SUSE-SU-2021:3761-1(SUSE Linux Enterprise Server 12-SP5 ) postgresql10-contrib-10.19-4.22.1.x86_64.rpmLinux
SUSE-SU-2021:3761-1(SUSE Linux Enterprise Server 12-SP5 ) postgresql10-contrib-debuginfo-10.19-4.22.1.x86_64.rpmLinux
SUSE-SU-2021:3761-1(SUSE Linux Enterprise Server 12-SP5 ) postgresql10-debuginfo-10.19-4.22.1.x86_64.rpmLinux
SUSE-SU-2021:3761-1(SUSE Linux Enterprise Server 12-SP5 ) postgresql10-debugsource-10.19-4.22.1.x86_64.rpmLinux
SUSE-SU-2021:3761-1(SUSE Linux Enterprise Server 12-SP5 ) postgresql10-docs-10.19-4.22.1.noarch.rpmLinux
SUSE-SU-2021:3761-1(SUSE Linux Enterprise Server 12-SP5 ) postgresql10-plperl-10.19-4.22.1.x86_64.rpmLinux
SUSE-SU-2021:3761-1(SUSE Linux Enterprise Server 12-SP5 ) postgresql10-plperl-debuginfo-10.19-4.22.1.x86_64.rpmLinux
SUSE-SU-2021:3761-1(SUSE Linux Enterprise Server 12-SP5 ) postgresql10-plpython-10.19-4.22.1.x86_64.rpmLinux
SUSE-SU-2021:3761-1(SUSE Linux Enterprise Server 12-SP5 ) postgresql10-plpython-debuginfo-10.19-4.22.1.x86_64.rpmLinux
SUSE-SU-2021:3761-1(SUSE Linux Enterprise Server 12-SP5 ) postgresql10-pltcl-10.19-4.22.1.x86_64.rpmLinux
SUSE-SU-2021:3761-1(SUSE Linux Enterprise Server 12-SP5 ) postgresql10-pltcl-debuginfo-10.19-4.22.1.x86_64.rpmLinux
SUSE-SU-2021:3761-1(SUSE Linux Enterprise Server 12-SP5 ) postgresql10-server-10.19-4.22.1.x86_64.rpmLinux
SUSE-SU-2021:3761-1(SUSE Linux Enterprise Server 12-SP5 ) postgresql10-server-debuginfo-10.19-4.22.1.x86_64.rpmLinux
Pg_repack update (ELSA-2021-5235) pg_repack-1.4.6-3.module+el8.5.0+20333+86306fc7.x86_64.rpmLinux
Pgaudit update (ELSA-2021-5235) pgaudit-1.4.0-5.module+el8.5.0+20333+86306fc7.x86_64.rpmLinux
Postgres-decoderbufs update (ELSA-2021-5235) postgres-decoderbufs-0.10.0-2.module+el8.5.0+20333+86306fc7.x86_64.rpmLinux
Postgresql update (ELSA-2021-5235) postgresql-12.9-1.module+el8.5.0+20463+3d6b40f2.x86_64.rpmLinux
Postgresql-contrib update (ELSA-2021-5235) postgresql-contrib-12.9-1.module+el8.5.0+20463+3d6b40f2.x86_64.rpmLinux
Postgresql-docs update (ELSA-2021-5235) postgresql-docs-12.9-1.module+el8.5.0+20463+3d6b40f2.x86_64.rpmLinux
Postgresql-plperl update (ELSA-2021-5235) postgresql-plperl-12.9-1.module+el8.5.0+20463+3d6b40f2.x86_64.rpmLinux
Postgresql-plpython3 update (ELSA-2021-5235) postgresql-plpython3-12.9-1.module+el8.5.0+20463+3d6b40f2.x86_64.rpmLinux
Postgresql-pltcl update (ELSA-2021-5235) postgresql-pltcl-12.9-1.module+el8.5.0+20463+3d6b40f2.x86_64.rpmLinux
Postgresql-server update (ELSA-2021-5235) postgresql-server-12.9-1.module+el8.5.0+20463+3d6b40f2.x86_64.rpmLinux
Postgresql-server-devel update (ELSA-2021-5235) postgresql-server-devel-12.9-1.module+el8.5.0+20463+3d6b40f2.x86_64.rpmLinux
Postgresql-static update (ELSA-2021-5235) postgresql-static-12.9-1.module+el8.5.0+20463+3d6b40f2.x86_64.rpmLinux
Postgresql-test update (ELSA-2021-5235) postgresql-test-12.9-1.module+el8.5.0+20463+3d6b40f2.x86_64.rpmLinux
Postgresql-test-rpm-macros update (ELSA-2021-5235) postgresql-test-rpm-macros-12.9-1.module+el8.5.0+20463+3d6b40f2.noarch.rpmLinux
Postgresql-upgrade update (ELSA-2021-5235) postgresql-upgrade-12.9-1.module+el8.5.0+20463+3d6b40f2.x86_64.rpmLinux
Postgresql-upgrade-devel update (ELSA-2021-5235) postgresql-upgrade-devel-12.9-1.module+el8.5.0+20463+3d6b40f2.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update pg_repack-debugsource-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgres-decoderbufs-0.10.0-2.module+el8.5.0+11354+78b3c9c5.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgres-decoderbufs-debugsource-0.10.0-2.module+el8.5.0+11354+78b3c9c5.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgresql-12.9-1.module+el8.5.0+13373+4554acc4.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgresql-contrib-12.9-1.module+el8.5.0+13373+4554acc4.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgresql-debugsource-12.9-1.module+el8.5.0+13373+4554acc4.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgresql-docs-12.9-1.module+el8.5.0+13373+4554acc4.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgresql-plperl-12.9-1.module+el8.5.0+13373+4554acc4.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgresql-plpython3-12.9-1.module+el8.5.0+13373+4554acc4.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgresql-pltcl-12.9-1.module+el8.5.0+13373+4554acc4.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgresql-server-12.9-1.module+el8.5.0+13373+4554acc4.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgresql-server-devel-12.9-1.module+el8.5.0+13373+4554acc4.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgresql-static-12.9-1.module+el8.5.0+13373+4554acc4.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgresql-test-12.9-1.module+el8.5.0+13373+4554acc4.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgresql-test-rpm-macros-12.9-1.module+el8.5.0+13373+4554acc4.noarch.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgresql-upgrade-12.9-1.module+el8.5.0+13373+4554acc4.x86_64.rpmLinux
(RHSA-2021:5235) postgresql:12 security update postgresql-upgrade-devel-12.9-1.module+el8.5.0+13373+4554acc4.x86_64.rpmLinux
(RHSA-2021:5236) postgresql:13 security update pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64.rpmLinux
(RHSA-2021:5236) postgresql:13 security update pg_repack-debugsource-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64.rpmLinux
(RHSA-2021:5236) postgresql:13 security update postgresql-contrib-13.5-1.module+el8.5.0+13344+8c0fd184.x86_64.rpmLinux
(RHSA-2021:5236) postgresql:13 security update postgresql-debugsource-13.5-1.module+el8.5.0+13344+8c0fd184.x86_64.rpmLinux
(RHSA-2021:5236) postgresql:13 security update postgresql-plperl-13.5-1.module+el8.5.0+13344+8c0fd184.x86_64.rpmLinux
(RHSA-2021:5236) postgresql:13 security update postgresql-plpython3-13.5-1.module+el8.5.0+13344+8c0fd184.x86_64.rpmLinux
(RHSA-2021:5236) postgresql:13 security update postgresql-pltcl-13.5-1.module+el8.5.0+13344+8c0fd184.x86_64.rpmLinux
(RHSA-2021:5236) postgresql:13 security update postgresql-server-devel-13.5-1.module+el8.5.0+13344+8c0fd184.x86_64.rpmLinux
(RHSA-2021:5236) postgresql:13 security update postgresql-static-13.5-1.module+el8.5.0+13344+8c0fd184.x86_64.rpmLinux
(RHSA-2021:5236) postgresql:13 security update postgresql-test-13.5-1.module+el8.5.0+13344+8c0fd184.x86_64.rpmLinux
(RHSA-2021:5236) postgresql:13 security update postgresql-test-rpm-macros-13.5-1.module+el8.5.0+13344+8c0fd184.noarch.rpmLinux
(RHSA-2021:5236) postgresql:13 security update postgresql-upgrade-13.5-1.module+el8.5.0+13344+8c0fd184.x86_64.rpmLinux
(RHSA-2021:5236) postgresql:13 security update postgresql-upgrade-devel-13.5-1.module+el8.5.0+13344+8c0fd184.x86_64.rpmLinux
(RHSA-2022:1830) postgresql:10 security update postgresql-10.19-1.module+el8.6.0+13642+78853f5a.x86_64.rpmLinux
(RHSA-2022:1830) postgresql:10 security update postgresql-contrib-10.19-1.module+el8.6.0+13642+78853f5a.x86_64.rpmLinux
(RHSA-2022:1830) postgresql:10 security update postgresql-debugsource-10.19-1.module+el8.6.0+13642+78853f5a.x86_64.rpmLinux
(RHSA-2022:1830) postgresql:10 security update postgresql-docs-10.19-1.module+el8.6.0+13642+78853f5a.x86_64.rpmLinux
(RHSA-2022:1830) postgresql:10 security update postgresql-plperl-10.19-1.module+el8.6.0+13642+78853f5a.x86_64.rpmLinux
(RHSA-2022:1830) postgresql:10 security update postgresql-plpython3-10.19-1.module+el8.6.0+13642+78853f5a.x86_64.rpmLinux
(RHSA-2022:1830) postgresql:10 security update postgresql-pltcl-10.19-1.module+el8.6.0+13642+78853f5a.x86_64.rpmLinux
(RHSA-2022:1830) postgresql:10 security update postgresql-server-10.19-1.module+el8.6.0+13642+78853f5a.x86_64.rpmLinux
(RHSA-2022:1830) postgresql:10 security update postgresql-server-devel-10.19-1.module+el8.6.0+13642+78853f5a.x86_64.rpmLinux
(RHSA-2022:1830) postgresql:10 security update postgresql-static-10.19-1.module+el8.6.0+13642+78853f5a.x86_64.rpmLinux
(RHSA-2022:1830) postgresql:10 security update postgresql-test-10.19-1.module+el8.6.0+13642+78853f5a.x86_64.rpmLinux
(RHSA-2022:1830) postgresql:10 security update postgresql-test-rpm-macros-10.19-1.module+el8.6.0+13642+78853f5a.x86_64.rpmLinux
(RHSA-2022:1830) postgresql:10 security update postgresql-upgrade-10.19-1.module+el8.6.0+13642+78853f5a.x86_64.rpmLinux
(RHSA-2022:1830) postgresql:10 security update postgresql-upgrade-devel-10.19-1.module+el8.6.0+13642+78853f5a.x86_64.rpmLinux
Postgresql update (ELSA-2023-4539) postgresql-10.23-2.0.1.module+el8.8.0+21144+bb6efc6c.x86_64.rpmLinux
Postgresql-contrib update (ELSA-2023-4539) postgresql-contrib-10.23-2.0.1.module+el8.8.0+21144+bb6efc6c.x86_64.rpmLinux
Postgresql-docs update (ELSA-2023-4539) postgresql-docs-10.23-2.0.1.module+el8.8.0+21144+bb6efc6c.x86_64.rpmLinux
Postgresql-plperl update (ELSA-2023-4539) postgresql-plperl-10.23-2.0.1.module+el8.8.0+21144+bb6efc6c.x86_64.rpmLinux
Postgresql-plpython3 update (ELSA-2023-4539) postgresql-plpython3-10.23-2.0.1.module+el8.8.0+21144+bb6efc6c.x86_64.rpmLinux
Postgresql-pltcl update (ELSA-2023-4539) postgresql-pltcl-10.23-2.0.1.module+el8.8.0+21144+bb6efc6c.x86_64.rpmLinux
Postgresql-server update (ELSA-2023-4539) postgresql-server-10.23-2.0.1.module+el8.8.0+21144+bb6efc6c.x86_64.rpmLinux
Postgresql-server-devel update (ELSA-2023-4539) postgresql-server-devel-10.23-2.0.1.module+el8.8.0+21144+bb6efc6c.x86_64.rpmLinux
Postgresql-static update (ELSA-2023-4539) postgresql-static-10.23-2.0.1.module+el8.8.0+21144+bb6efc6c.x86_64.rpmLinux
Postgresql-test update (ELSA-2023-4539) postgresql-test-10.23-2.0.1.module+el8.8.0+21144+bb6efc6c.x86_64.rpmLinux
Postgresql-test-rpm-macros update (ELSA-2023-4539) postgresql-test-rpm-macros-10.23-2.0.1.module+el8.8.0+21144+bb6efc6c.x86_64.rpmLinux
Postgresql-upgrade update (ELSA-2023-4539) postgresql-upgrade-10.23-2.0.1.module+el8.8.0+21144+bb6efc6c.x86_64.rpmLinux
Postgresql-upgrade-devel update (ELSA-2023-4539) postgresql-upgrade-devel-10.23-2.0.1.module+el8.8.0+21144+bb6efc6c.x86_64.rpmLinux
Vulnerabilities CVE-2021-23222 Announcement,CVE-2021-23214 Announcement are fixed in Postgresql 14.1 (For Linux)Linux
Vulnerabilities CVE-2021-23222,CVE-2021-23214 are fixed in PostgreSQL 14.1 (For Linux)Linux
Vulnerabilities CVE-2021-23222,CVE-2021-23214 are fixed in PostgreSQL 13.5 (For Linux)Linux
Vulnerabilities CVE-2021-23222,CVE-2021-23214 are fixed in PostgreSQL 12.9 (For Linux)Linux
Vulnerabilities CVE-2021-23222,CVE-2021-23214 are fixed in PostgreSQL 11.14 (For Linux)Linux
Vulnerabilities CVE-2021-23222,CVE-2021-23214 are fixed in PostgreSQL 10.19 (For Linux)Linux
Vulnerabilities CVE-2021-23222,CVE-2021-23214 are fixed in PostgreSQL 9.6.24 (For Linux)Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234