CVE-2021-23222: Medium severity ibm storage protect plus vulnerability
A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.
Other sources
PostgreSQL is vulnerable to a man-in-the-middle attack, caused by improper validation of user-supplied input by libpq. A remote attacker could exploit this vulnerability to launch a man-in-the-middle attack to inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-23222?
CVE-2021-23222 is a vulnerability in PostgreSQL that allows a man-in-the-middle attacker to inject false responses to the client's queries.
How does CVE-2021-23222 affect PostgreSQL?
CVE-2021-23222 affects versions of PostgreSQL up to 9.6.24, 10.19, 11.14, 12.9, 13.5, and 14.0.
What is the severity of CVE-2021-23222?
The severity of CVE-2021-23222 is medium, with a CVSS score of 5.9.
How can a man-in-the-middle attack be prevented in PostgreSQL?
To prevent a man-in-the-middle attack in PostgreSQL, users should update to the latest version that includes the fix.
Where can I find more information about CVE-2021-23222?
More information about CVE-2021-23222 can be found on Red Hat Bugzilla and the official PostgreSQL git repository.