CVE-2021-43767
First published: Thu Aug 25 2022(Updated: )
Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's first few queries. Despite the use of SSL certificate verification and encryption, Odyssey will pass these results to client as if they originated from valid server. This is similar to CVE-2021-23222 for PostgreSQL.
Credit: patrick@puiterwijk.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PostgreSQL PostgreSQL | >=9.6.0<9.6.24 | |
| PostgreSQL PostgreSQL | >=10.0<10.19 | |
| PostgreSQL PostgreSQL | >=11.0<11.14 | |
| PostgreSQL PostgreSQL | >=12.0<12.9 | |
| PostgreSQL PostgreSQL | >=13.0<13.5 | |
| PostgreSQL PostgreSQL | =14.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-43767.
What is the severity of CVE-2021-43767?
The severity of CVE-2021-43767 is medium with a severity value of 5.9.
How does Odyssey pass unencrypted bytes to the client from a man-in-the-middle?
Odyssey passes unencrypted bytes to the client from a man-in-the-middle when it is configured to use the PostgreSQL server using 'trust' or 'cert' authentication.
Which versions of PostgreSQL are affected by CVE-2021-43767?
PostgreSQL versions 9.6.0 to 9.6.24, 10.0 to 10.19, 11.0 to 11.14, 12.0 to 12.9, 13.0 to 13.5, and 14.0 are affected by CVE-2021-43767.
How can the vulnerability CVE-2021-43767 be fixed?
To fix CVE-2021-43767, update PostgreSQL to a version higher than the affected versions.
- agent/severity
- agent/author
- agent/weakness
- agent/references
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/postgresql
- canonical/postgresql postgresql
- version/postgresql postgresql/9.6.0
- version/postgresql postgresql/10.0
- version/postgresql postgresql/11.0
- version/postgresql postgresql/12.0
- version/postgresql postgresql/13.0
- version/postgresql postgresql/14.0