Affected: AlmaLinux:8: libpq, AlmaLinux:8: libpq-devel

The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers.

Security Fix(es):

* postgresql: libpq processes unencrypted bytes from man-in-the-middle (CVE-2021-23222)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Withdrawn by the publisher.

Affected: Bitnami: postgresql

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

Affected: CleanStart: postgresql15

Security vulnerability affects the postgresql15 package. This issue is resolved in later releases. See references for vulnerability details.

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

Affected: openEuler:20.03-LTS-SP1: postgresql, openEuler:20.03-LTS-SP2: postgresql, openEuler:20.03-LTS-SP3: postgresql

PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL constructs (including transactions, subselects and user-defined types and functions). The postgresql package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server. Security Fix(es): When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.(CVE-2021-23214) A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.(CVE-2021-23222)

Security update for postgresql10

postgresql: memory disclosure in certain queries postgresql: server processes unencrypted bytes from man-in-the-middle postgresql: libpq processes unencrypted bytes from man-in-the-middle

Security update for postgresql, postgresql13, postgresql14

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen.