Most recent entries from all

ALSA-2021:5235 — Moderate: postgresql:12 security update

Affected: AlmaLinux:8: pg_repack, AlmaLinux:8: pgaudit, AlmaLinux:8: postgres-decoderbufs, AlmaLinux:8: postgresql, AlmaLinux:8: postgresql-contrib, AlmaLinux:8: postgresql-docs, AlmaLinux:8: postgresql-plperl, AlmaLinux:8: postgresql-plpython3, AlmaLinux:8: postgresql-pltcl, AlmaLinux:8: postgresql-server and 6 more

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (12.9).

Security Fix(es):

* postgresql: memory disclosure in certain queries (CVE-2021-3677)

* postgresql: server processes unencrypted bytes from man-in-the-middle (CVE-2021-23214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2021-05857

Withdrawn: BELL-CVE-2021-23214 — CVE-2021-23214 does not affect BellSoft software

Withdrawn by the publisher.

BIT-postgresql-2021-23214

Affected: Bitnami: postgresql

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

certfr-2021-avi-867 — De multiples vulnérabilités ont été découvertes dans PostgreSQL. Elles permettent à un attaquant de provoquer un contou…

certfr-2021-avi-867

Withdrawn: CLEANSTART-2026-FW42039 — vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row secur…

Withdrawn by the publisher.

Affected: CleanStart: postgresql

Multiple security vulnerabilities affect the postgresql package. A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. See references for individual vulnerability details.

EUVD-2026-23366

fkie_cve-2021-23214

GHSA-467w-rrqc-395f

gsd-2021-23214

msrc_CVE-2021-23214 — When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication a…

msrc_CVE-2021-23214

OESA-2022-1575 — postgresql security update

Affected: openEuler:20.03-LTS-SP1: postgresql, openEuler:20.03-LTS-SP2: postgresql, openEuler:20.03-LTS-SP3: postgresql

PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL constructs (including transactions, subselects and user-defined types and functions). The postgresql package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server. Security Fix(es): When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.(CVE-2021-23214) A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.(CVE-2021-23222)

openSUSE-SU-2021:1584-1 — Security update for postgresql10

Security update for postgresql10

RHSA-2021:5179 — Red Hat Security Advisory: rh-postgresql13-postgresql security update

postgresql: memory disclosure in certain queries postgresql: server processes unencrypted bytes from man-in-the-middle postgresql: libpq processes unencrypted bytes from man-in-the-middle

SUSE-SU-2021:3755-1 — Security update for postgresql, postgresql13, postgresql14

Security update for postgresql, postgresql13, postgresql14

UBUNTU-CVE-2021-23214

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12

WID-SEC-W-2022-0031 — PostgreSQL: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen.