CVE-2021-43767: Medium severity postgresql common vulnerability
Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's first few queries. Despite the use of SSL certificate verification and encryption, Odyssey will pass these results to client as if they originated from valid server. This is similar to CVE-2021-23222 for PostgreSQL.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-43767.
What is the severity of CVE-2021-43767?
The severity of CVE-2021-43767 is medium with a severity value of 5.9.
How does Odyssey pass unencrypted bytes to the client from a man-in-the-middle?
Odyssey passes unencrypted bytes to the client from a man-in-the-middle when it is configured to use the PostgreSQL server using 'trust' or 'cert' authentication.
Which versions of PostgreSQL are affected by CVE-2021-43767?
PostgreSQL versions 9.6.0 to 9.6.24, 10.0 to 10.19, 11.0 to 11.14, 12.0 to 12.9, 13.0 to 13.5, and 14.0 are affected by CVE-2021-43767.
How can the vulnerability CVE-2021-43767 be fixed?
To fix CVE-2021-43767, update PostgreSQL to a version higher than the affected versions.