Missing Encryption of Sensitive Data in PostgreSQL - CVE-2021-23222

Vulnerability identifier: #VU58114

CSH Severity: Medium

CVSS v4: 7.6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-23222

CWE-ID: CWE-311

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to the way the libpq process in PostgreSQL handles encrypted connections. A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption. The attacker can exfiltrate the client's password or other confidential data that might be transmitted early in a session.

PostgreSQL
Gentoo Linux
SUSE CaaS Platform
SUSE Enterprise Storage
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
Fedora
Anolis OS
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Module for Legacy Software
Ubuntu
openEuler
Red Hat Software Collections
Red Hat Advanced Cluster Security for Kubernetes
postgresql-11 (Debian package)
rh-postgresql12-postgresql (Red Hat package)
postgresql-13 (Debian package)
rh-postgresql13-postgresql (Red Hat package)
SUSE Linux Enterprise Module for Packagehub Subpackages
postgresql-9.5 (Ubuntu package)
pgbouncer
postgresql96-plperl-debuginfo
postgresql96-docs
postgresql96
postgresql96-contrib
postgresql96-contrib-debuginfo
postgresql96-debuginfo
postgresql96-debugsource
postgresql96-plperl
postgresql96-plpython
postgresql96-plpython-debuginfo
postgresql96-pltcl
postgresql96-pltcl-debuginfo
postgresql96-server
postgresql96-server-debuginfo
postgresql-server
postgresql-devel
postgresql-help
postgresql-debuginfo
postgresql-test
postgresql-libs
postgresql-plperl
postgresql-contrib
postgresql-plpython3
postgresql-static
postgresql-test-rpm-macros
postgresql-pltcl
postgresql-debugsource
postgresql
postgresql-10 (Ubuntu package)
postgresql10-pltcl-debuginfo
postgresql10-server
postgresql10-server-debuginfo
postgresql10-devel
postgresql10-plpython-debuginfo
postgresql10-pltcl
postgresql10-devel-debuginfo
postgresql10-docs
postgresql10
postgresql10-contrib
postgresql10-contrib-debuginfo
postgresql10-debugsource
postgresql10-debuginfo
postgresql10-plpython
postgresql10-plperl-debuginfo
postgresql10-plperl
libpq5-32bit-debuginfo
libpq5-32bit
libecpg6
libecpg6-debuginfo
libpq5
libpq5-debuginfo
libpq
libpq-debuginfo
libpq-devel
libpq-debugsource
postgresql-docs
postgresql-plpython
postgresql-server-devel
postgresql-12 (Ubuntu package)
postgresql12-server-devel
postgresql12-contrib-debuginfo
postgresql12-server-devel-debuginfo
postgresql12
postgresql12-contrib
postgresql12-debuginfo
postgresql12-plperl
postgresql12-plperl-debuginfo
postgresql12-plpython
postgresql12-plpython-debuginfo
postgresql12-pltcl
postgresql12-pltcl-debuginfo
postgresql12-server
postgresql12-server-debuginfo
postgresql12-docs
postgresql12-devel
postgresql12-debugsource
postgresql12-devel-debuginfo
postgresql12-llvmjit
postgresql12-llvmjit-debuginfo
postgresql12-test
postgresql-13-debugsource
postgresql-13-test-rpm-macros
postgresql-13-server
postgresql-13-pltcl
postgresql-13-plpython3
postgresql-13-server-devel
postgresql-13-docs
postgresql-13-debuginfo
postgresql-13-static
postgresql-13-llvmjit
postgresql-13
postgresql-13-plperl
postgresql-13-test
postgresql-13-contrib
postgresql-llvmjit
postgresql-13 (Ubuntu package)
libpq (Red Hat package)
postgresql13-docs
postgresql13-server-debuginfo
postgresql13-server
postgresql13-pltcl-debuginfo
postgresql13-pltcl
postgresql13-plpython-debuginfo
postgresql13-plpython
postgresql13-plperl-debuginfo
postgresql13-plperl
postgresql13-debuginfo
postgresql13-contrib-debuginfo
postgresql13-contrib
postgresql13
postgresql13-server-devel-debuginfo
postgresql13-server-devel
postgresql13-devel-debuginfo
postgresql13-devel
postgresql13-debugsource
postgresql13-test
postgresql13-llvmjit
postgresql13-llvmjit-debuginfo
postgresql14-contrib
postgresql14-server-devel-debuginfo
postgresql14-server-devel
postgresql14-devel-debuginfo
postgresql14-devel
postgresql14-debugsource
libpq5-debuginfo-32bit
postgresql14
postgresql14-contrib-debuginfo
postgresql14-debuginfo
postgresql14-plperl-debuginfo
postgresql14-plpython
postgresql14-plperl
postgresql14-plpython-debuginfo
postgresql14-pltcl
postgresql14-pltcl-debuginfo
postgresql14-server
postgresql14-server-debuginfo
postgresql14-docs
postgresql14-test
postgresql14-llvmjit-debuginfo
postgresql14-llvmjit
IBM Security Guardium
Zoho ManageEngine OpManager
IBM Cloud Pak for Multicloud Management
VMware Tanzu Operations Manager

Install updates from vendor's website.

PostgreSQL - addressed in versions 9.6.24, 10.19, 11.14, 12.9, 13.5, 14.1
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 3.68.2, 3.69.2, 3.70
postgresql-11 (Debian package) - update to 11.14-0+deb10u1
rh-postgresql12-postgresql (Red Hat package) - update to 12.9-1.el7
Zoho ManageEngine OpManager - update to 12.5 125630
postgresql-13 (Debian package) - update to 13.5-0+deb11u1
rh-postgresql13-postgresql (Red Hat package) - update to 13.5-1.el7
postgresql-9.5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
pgbouncer - update to 1.16.1-2.el8
IBM Cloud Pak for Multicloud Management - update to 2.3.5
VMware Tanzu Operations Manager - update to 2.10.9
postgresql96-plperl-debuginfo - update to 9.6.24-6.18.2
postgresql96-docs - update to 9.6.24-6.18.2
postgresql96 - update to 9.6.24-6.18.2
postgresql96-contrib - update to 9.6.24-6.18.2
postgresql96-contrib-debuginfo - update to 9.6.24-6.18.2
postgresql96-debuginfo - update to 9.6.24-6.18.2
postgresql96-debugsource - update to 9.6.24-6.18.2
postgresql96-plperl - update to 9.6.24-6.18.2
postgresql96-plpython - update to 9.6.24-6.18.2
postgresql96-plpython-debuginfo - update to 9.6.24-6.18.2
postgresql96-pltcl - update to 9.6.24-6.18.2
postgresql96-pltcl-debuginfo - update to 9.6.24-6.18.2
postgresql96-server - update to 9.6.24-6.18.2
postgresql96-server-debuginfo - update to 9.6.24-6.18.2
postgresql-server - addressed in versions 10.5-23, 13.3-7
postgresql-devel - update to 10.5-23
postgresql-help - update to 10.5-23
postgresql-debuginfo - addressed in versions 10.5-23, 13.3-7
postgresql-test - addressed in versions 10.5-23, 13.3-7
postgresql-libs - update to 10.5-23
postgresql-plperl - addressed in versions 10.5-23, 13.3-7
postgresql-contrib - addressed in versions 10.5-23, 13.3-7
postgresql-plpython3 - addressed in versions 10.5-23, 13.3-7
postgresql-static - addressed in versions 10.5-23, 13.3-7
postgresql-test-rpm-macros - addressed in versions 10.5-23, 13.3-7
postgresql-pltcl - addressed in versions 10.5-23, 13.3-7
postgresql-debugsource - addressed in versions 10.5-23, 13.3-7
postgresql - addressed in versions 10.5-23, 13.3-7
postgresql-10 (Ubuntu package) - update to 10.19-0ubuntu0.18.04.1
postgresql10-pltcl-debuginfo - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-server - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-server-debuginfo - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-devel - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-plpython-debuginfo - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-pltcl - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-devel-debuginfo - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-docs - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10 - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-contrib - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-contrib-debuginfo - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-debugsource - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-debuginfo - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-plpython - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-plperl-debuginfo - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-plperl - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
libpq5-32bit-debuginfo - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.1-5.6.1
libpq5-32bit - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.1-3.3.1, 14.1-5.6.1
libecpg6 - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.1-3.3.1, 14.1-5.6.1
libecpg6-debuginfo - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.1-3.3.1, 14.1-5.6.1
libpq5 - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.1-3.3.1, 14.1-5.6.1
libpq5-debuginfo - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.1-3.3.1, 14.1-5.6.1
libpq - update to 11.16-1
libpq-debuginfo - update to 11.16-1
libpq-devel - update to 11.16-1
libpq-debugsource - update to 11.16-1
postgresql-docs - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-devel - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-contrib - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-plperl - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-plpython - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-pltcl - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-server - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-server-devel - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-12 (Ubuntu package) - update to 12.9-0ubuntu0.20.04.1
postgresql12-server-devel - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-contrib-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-server-devel-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12 - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-contrib - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-plperl - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-plperl-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-plpython - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-plpython-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-pltcl - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-pltcl-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-server - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-server-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-docs - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-devel - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-debugsource - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-devel-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-llvmjit - update to 12.9-8.26.1
postgresql12-llvmjit-debuginfo - update to 12.9-8.26.1
postgresql12-test - update to 12.9-8.26.1
postgresql-13-debugsource - update to 13.3-2
postgresql-13-test-rpm-macros - update to 13.3-2
postgresql-13-server - update to 13.3-2
postgresql-13-pltcl - update to 13.3-2
postgresql-13-plpython3 - update to 13.3-2
postgresql-13-server-devel - update to 13.3-2
postgresql-13-docs - update to 13.3-2
postgresql-13-debuginfo - update to 13.3-2
postgresql-13-static - update to 13.3-2
postgresql-13-llvmjit - update to 13.3-2
postgresql-13 - update to 13.3-2
postgresql-13-plperl - update to 13.3-2
postgresql-13-test - update to 13.3-2
postgresql-13-contrib - update to 13.3-2
postgresql-server-devel - update to 13.3-7
postgresql-docs - update to 13.3-7
postgresql-llvmjit - update to 13.3-7
postgresql-13 (Ubuntu package) - addressed in versions 13.5-0ubuntu0.21.04.1, 13.5-0ubuntu0.21.10.1
libpq-devel - update to 13.5-1
libpq - update to 13.5-1
libpq (Red Hat package) - update to 13.5-1.el8
postgresql13-docs - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-server-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-server - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-pltcl-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-pltcl - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-plpython-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-plpython - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-plperl-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-plperl - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-contrib-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-contrib - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13 - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-server-devel-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-server-devel - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-devel-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-devel - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-debugsource - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-test - update to 13.5-5.22.1
postgresql13-llvmjit - update to 13.5-5.22.1
postgresql13-llvmjit-debuginfo - update to 13.5-5.22.1
postgresql14-contrib - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-server-devel-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-server-devel - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-devel-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-devel - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-debugsource - addressed in versions 14.1-3.3.1, 14.1-5.6.1
libpq5-debuginfo-32bit - update to 14.1-3.3.1
postgresql14 - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-contrib-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-plperl-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-plpython - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-plperl - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-plpython-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-pltcl - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-pltcl-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-server - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-server-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-docs - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-test - update to 14.1-5.6.1
postgresql14-llvmjit-debuginfo - update to 14.1-5.6.1
postgresql14-llvmjit - update to 14.1-5.6.1

• https://www.postgresql.org/about/news/postgresql-141-135-129-1114-1019-and-9624-released-2349/

• Multiple vulnerabilities in PostgreSQL
• Debian update for postgresql-11
• Debian update for postgresql-13
• Red Hat Software Collections update for rh-postgresql12-postgresql
• Red Hat Software Collections update for rh-postgresql13-postgresql
• Zoho ManageEngine OpManager update for PostgreSQL
• Multiple vulnerabilities in IBM Security Guardium
• Red Hat Enterprise Linux 8 update for libpq
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes
• SUSE update for postgresql, postgresql13, postgresql14
• SUSE update for postgresql96
• SUSE update for postgresql12
• SUSE update for postgresql14
• SUSE update for postgresql12
• SUSE update for postgresql10
• SUSE update for postgresql13
• SUSE update for postgresql10
• Ubuntu update for postgresql-10
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes (RHACS)
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes (RHACS)
• SUSE update for postgresql10
• SUSE update for postgresql12
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Infrastructure Management
• Gentoo update for PostgreSQL
• Ubuntu update for postgresql-9.5
• VMware Tanzu Operations Manager update for PostgreSQL
• openEuler update for postgresql
• openEuler update for postgresql-13
• openEuler 22.03 LTS update for libpq
• openEuler 22.03 LTS update for postgresql
• Fedora EPEL 8 update for pgbouncer
• Anolis OS update for libpq