QwikSec

Security Database

CVE

CWE

Training

CVE-2021-23214

Published: Mar 4, 2022

Modified: Aug 3, 2024

PUBLISHED

Description

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

Vendor	Product	Versions
n/a	postgresql	affected `Affects v9.6 to v14`

Weaknesses (CWE)

References

https://bugzilla.redhat.com/show_bug.cgi?id=2022666

https://www.postgresql.org/support/security/CVE-2021-23214/

https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commit%3Bh=28e24125541545483093819efae9bca603441951

https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.