Most recent entries from all

ALSA-2022:1891 — Low: libpq security update

Affected: AlmaLinux:8: libpq, AlmaLinux:8: libpq-devel

The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers.

Security Fix(es):

* postgresql: libpq processes unencrypted bytes from man-in-the-middle (CVE-2021-23222)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-05535

Withdrawn: BELL-CVE-2021-23222 — CVE-2021-23222 does not affect BellSoft software

Withdrawn by the publisher.

BIT-postgresql-2021-23222

Affected: Bitnami: postgresql

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

certfr-2021-avi-867 — De multiples vulnérabilités ont été découvertes dans PostgreSQL. Elles permettent à un attaquant de provoquer un contou…

certfr-2021-avi-867

CLEANSTART-2026-EL15965 — Security fix for CVE-2021-23222 applied in: postgresql15 14.1-r0

Affected: CleanStart: postgresql15

Security vulnerability affects the postgresql15 package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-23352

fkie_cve-2021-23222

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

GHSA-735f-7qx4-jqq5

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

gsd-2021-23222

msrc_CVE-2021-23222 — A man-in-the-middle attacker can inject false responses to the client's first few queries despite the use of SSL certif…

msrc_CVE-2021-23222

OESA-2022-1575 — postgresql security update

Affected: openEuler:20.03-LTS-SP1: postgresql, openEuler:20.03-LTS-SP2: postgresql, openEuler:20.03-LTS-SP3: postgresql

PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL constructs (including transactions, subselects and user-defined types and functions). The postgresql package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server. Security Fix(es): When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.(CVE-2021-23214) A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.(CVE-2021-23222)

openSUSE-SU-2021:1584-1 — Security update for postgresql10

Security update for postgresql10

RHSA-2021:5179 — Red Hat Security Advisory: rh-postgresql13-postgresql security update

postgresql: memory disclosure in certain queries postgresql: server processes unencrypted bytes from man-in-the-middle postgresql: libpq processes unencrypted bytes from man-in-the-middle

SUSE-SU-2021:3755-1 — Security update for postgresql, postgresql13, postgresql14

Security update for postgresql, postgresql13, postgresql14

UBUNTU-CVE-2021-23222

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

WID-SEC-W-2022-0031 — PostgreSQL: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen.