Missing Encryption of Sensitive Data in PostgreSQL - CVE-2021-23214

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU58113

Missing Encryption of Sensitive Data in PostgreSQL - CVE-2021-23214

Published: November 11, 2021


Vulnerability identifier: #VU58113
CSH Severity: Medium
CVSS v4: 7.6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-23214
CWE-ID: CWE-311
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to the way PostgreSQL handles encrypted connections. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.


Affected software

PostgreSQL
Gentoo Linux
Amazon Linux AMI
Arch Linux
SUSE CaaS Platform
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
Anolis OS
Fedora
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Legacy Software
Ubuntu
openEuler
Red Hat Software Collections
postgresql-11 (Debian package)
rh-postgresql12-postgresql (Red Hat package)
postgresql-13 (Debian package)
rh-postgresql13-postgresql (Red Hat package)
SUSE Linux Enterprise Module for Packagehub Subpackages
postgres-decoderbufs
pgaudit
pg_repack
pgbouncer
postgresql92
postgresql93
postgresql94
postgresql95
postgresql-9.5 (Ubuntu package)
postgresql96
postgresql96-debugsource
postgresql96-server
postgresql96-pltcl-debuginfo
postgresql96-pltcl
postgresql96-plpython-debuginfo
postgresql96-plpython
postgresql96-plperl-debuginfo
postgresql96-plperl
postgresql96-debuginfo
postgresql96-contrib-debuginfo
postgresql96-contrib
postgresql96-server-debuginfo
postgresql96-docs
postgresql-test-rpm-macros
postgresql-devel
postgresql
postgresql-debugsource
postgresql-pltcl
postgresql-plpython3
postgresql-static
postgresql-test
postgresql-contrib
postgresql-plperl
postgresql-libs
postgresql-debuginfo
postgresql-help
postgresql-server
postgresql-10 (Ubuntu package)
postgresql-docs
postgresql-server-devel
postgresql-upgrade
postgresql-upgrade-devel
postgresql10-debugsource
postgresql10-docs
postgresql10
postgresql10-contrib
postgresql10-contrib-debuginfo
postgresql10-devel-debuginfo
postgresql10-devel
postgresql10-server-debuginfo
postgresql10-server
postgresql10-pltcl-debuginfo
postgresql10-pltcl
postgresql10-plpython-debuginfo
postgresql10-plpython
postgresql10-plperl-debuginfo
postgresql10-plperl
postgresql10-debuginfo
libpq5-32bit
libpq5-32bit-debuginfo
libpq5-debuginfo
libpq5
libecpg6-debuginfo
libecpg6
postgresql-plpython
postgresql-12 (Ubuntu package)
postgresql12-server-debuginfo
postgresql12-debugsource
postgresql12-devel
postgresql12-devel-debuginfo
postgresql12-server-devel
postgresql12-server-devel-debuginfo
postgresql12
postgresql12-contrib
postgresql12-contrib-debuginfo
postgresql12-debuginfo
postgresql12-plperl
postgresql12-plperl-debuginfo
postgresql12-plpython
postgresql12-plpython-debuginfo
postgresql12-pltcl
postgresql12-pltcl-debuginfo
postgresql12-server
postgresql12-docs
postgresql12-test
postgresql12-llvmjit-debuginfo
postgresql12-llvmjit
postgresql-13-test-rpm-macros
postgresql-13-plperl
postgresql-13-test
postgresql-13-llvmjit
postgresql-13-static
postgresql-13-debuginfo
postgresql-13-docs
postgresql-13-contrib
postgresql-13-debugsource
postgresql-13-server
postgresql-13-pltcl
postgresql-13-plpython3
postgresql-13-server-devel
postgresql-13
postgresql-llvmjit
postgresql-13 (Ubuntu package)
postgresql13-docs
postgresql13-server-debuginfo
postgresql13-server
postgresql13-pltcl-debuginfo
postgresql13-pltcl
postgresql13-plpython-debuginfo
postgresql13-plpython
postgresql13-plperl-debuginfo
postgresql13-plperl
postgresql13-debuginfo
postgresql13-debugsource
postgresql13-devel
postgresql13-devel-debuginfo
postgresql13-server-devel
postgresql13-server-devel-debuginfo
postgresql13
postgresql13-contrib
postgresql13-contrib-debuginfo
postgresql13-test
postgresql13-llvmjit
postgresql13-llvmjit-debuginfo
postgresql14-server-devel
postgresql14-docs
postgresql14-devel-debuginfo
postgresql14-server-debuginfo
postgresql14-server
postgresql14-pltcl-debuginfo
postgresql14-devel
postgresql14-debugsource
postgresql14-server-devel-debuginfo
libpq5-debuginfo-32bit
postgresql14-pltcl
postgresql14
postgresql14-contrib
postgresql14-contrib-debuginfo
postgresql14-debuginfo
postgresql14-plperl
postgresql14-plperl-debuginfo
postgresql14-plpython
postgresql14-plpython-debuginfo
postgresql14-llvmjit
postgresql14-llvmjit-debuginfo
postgresql14-test
Zoho ManageEngine OpManager
IBM Cloud Pak for Multicloud Management

How to mitigate CVE-2021-23214

Install updates from vendor's website.

PostgreSQL - addressed in versions 9.6.24, 10.19, 11.14, 12.9, 13.5, 14.1
postgresql-11 (Debian package) - update to 11.14-0+deb10u1
rh-postgresql12-postgresql (Red Hat package) - update to 12.9-1.el7
Zoho ManageEngine OpManager - update to 12.5 125630
postgresql-13 (Debian package) - update to 13.5-0+deb11u1
rh-postgresql13-postgresql (Red Hat package) - update to 13.5-1.el7
postgres-decoderbufs - update to 0.10.0-2
pgaudit - addressed in versions 1.4.0-5, 1.5.0-1
pg_repack - update to 1.4.6-3
pgbouncer - update to 1.16.1-2.el8
IBM Cloud Pak for Multicloud Management - update to 2.3.5
postgresql92 - update to 9.2.24-3.68
postgresql93 - update to 9.3.25-1.73
postgresql94 - update to 9.4.26-1.78
postgresql95 - update to 9.5.24-1.83
postgresql-9.5 (Ubuntu package) - update to 9.5.250ubuntu0.16.04.1+esm1
postgresql96 - update to 9.6.24-1.86
postgresql96-debugsource - update to 9.6.24-6.18.2
postgresql96-server - update to 9.6.24-6.18.2
postgresql96-pltcl-debuginfo - update to 9.6.24-6.18.2
postgresql96-pltcl - update to 9.6.24-6.18.2
postgresql96-plpython-debuginfo - update to 9.6.24-6.18.2
postgresql96-plpython - update to 9.6.24-6.18.2
postgresql96-plperl-debuginfo - update to 9.6.24-6.18.2
postgresql96-plperl - update to 9.6.24-6.18.2
postgresql96-debuginfo - update to 9.6.24-6.18.2
postgresql96-contrib-debuginfo - update to 9.6.24-6.18.2
postgresql96-contrib - update to 9.6.24-6.18.2
postgresql96-server-debuginfo - update to 9.6.24-6.18.2
postgresql96 - update to 9.6.24-6.18.2
postgresql96-docs - update to 9.6.24-6.18.2
postgresql-test-rpm-macros - addressed in versions 10.5-23, 13.3-7
postgresql-devel - update to 10.5-23
postgresql - addressed in versions 10.5-23, 13.3-7
postgresql-debugsource - addressed in versions 10.5-23, 13.3-7
postgresql-pltcl - addressed in versions 10.5-23, 13.3-7
postgresql-plpython3 - addressed in versions 10.5-23, 13.3-7
postgresql-static - addressed in versions 10.5-23, 13.3-7
postgresql-test - addressed in versions 10.5-23, 13.3-7
postgresql-contrib - addressed in versions 10.5-23, 13.3-7
postgresql-plperl - addressed in versions 10.5-23, 13.3-7
postgresql-libs - update to 10.5-23
postgresql-debuginfo - addressed in versions 10.5-23, 13.3-7
postgresql-help - update to 10.5-23
postgresql-server - addressed in versions 10.5-23, 13.3-7
postgresql-10 (Ubuntu package) - update to 10.19-0ubuntu0.18.04.1
postgresql-docs - addressed in versions 10.19-1.0.1, 12.9-1.0.1, 13.5-1.0.1
postgresql-plperl - addressed in versions 10.19-1.0.1, 12.9-1.0.1, 13.5-1.0.1
postgresql-contrib - addressed in versions 10.19-1.0.1, 12.9-1.0.1, 13.5-1.0.1
postgresql - addressed in versions 10.19-1.0.1, 12.9-1.0.1, 13.5-1.0.1
postgresql-plpython3 - addressed in versions 10.19-1.0.1, 12.9-1.0.1, 13.5-1.0.1
postgresql-pltcl - addressed in versions 10.19-1.0.1, 12.9-1.0.1, 13.5-1.0.1
postgresql-server - addressed in versions 10.19-1.0.1, 12.9-1.0.1, 13.5-1.0.1
postgresql-server-devel - addressed in versions 10.19-1.0.1, 12.9-1.0.1, 13.5-1.0.1
postgresql-static - addressed in versions 10.19-1.0.1, 12.9-1.0.1, 13.5-1.0.1
postgresql-test - addressed in versions 10.19-1.0.1, 12.9-1.0.1, 13.5-1.0.1
postgresql-test-rpm-macros - addressed in versions 10.19-1.0.1, 12.9-1.0.1, 13.5-1.0.1
postgresql-upgrade - addressed in versions 10.19-1.0.1, 12.9-1.0.1, 13.5-1.0.1
postgresql-upgrade-devel - addressed in versions 10.19-1.0.1, 12.9-1.0.1, 13.5-1.0.1
postgresql10-debugsource - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-docs - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10 - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-contrib - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-contrib-debuginfo - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-devel-debuginfo - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-devel - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-server-debuginfo - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-server - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-pltcl-debuginfo - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-pltcl - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-plpython-debuginfo - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-plpython - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-plperl-debuginfo - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-plperl - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
postgresql10-debuginfo - addressed in versions 10.19-4.22.1, 10.19-8.41.1, 10.22-150000.4.42.1
libpq5-32bit - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.1-3.3.1, 14.1-5.6.1
libpq5-32bit-debuginfo - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.1-5.6.1
libpq5-debuginfo - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.1-3.3.1, 14.1-5.6.1
libpq5 - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.1-3.3.1, 14.1-5.6.1
libecpg6-debuginfo - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.1-3.3.1, 14.1-5.6.1
libecpg6 - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.1-3.3.1, 14.1-5.6.1
postgresql - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-contrib - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-devel - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-docs - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-plperl - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-plpython - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-pltcl - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-server - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-server-devel - addressed in versions 12.0.1-150000.8.19.1, 14-4.10.1
postgresql-12 (Ubuntu package) - update to 12.9-0ubuntu0.20.04.1
postgresql12-server-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-debugsource - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-devel - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-devel-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-server-devel - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-server-devel-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12 - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-contrib - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-contrib-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-plperl - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-plperl-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-plpython - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-plpython-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-pltcl - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-pltcl-debuginfo - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-server - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-docs - addressed in versions 12.9-3.21.1, 12.9-8.26.1, 12.12-150100.3.33.1
postgresql12-test - update to 12.9-8.26.1
postgresql12-llvmjit-debuginfo - update to 12.9-8.26.1
postgresql12-llvmjit - update to 12.9-8.26.1
postgresql-13-test-rpm-macros - update to 13.3-2
postgresql-13-plperl - update to 13.3-2
postgresql-13-test - update to 13.3-2
postgresql-13-llvmjit - update to 13.3-2
postgresql-13-static - update to 13.3-2
postgresql-13-debuginfo - update to 13.3-2
postgresql-13-docs - update to 13.3-2
postgresql-13-contrib - update to 13.3-2
postgresql-13-debugsource - update to 13.3-2
postgresql-13-server - update to 13.3-2
postgresql-13-pltcl - update to 13.3-2
postgresql-13-plpython3 - update to 13.3-2
postgresql-13-server-devel - update to 13.3-2
postgresql-13 - update to 13.3-2
postgresql-docs - update to 13.3-7
postgresql-server-devel - update to 13.3-7
postgresql-llvmjit - update to 13.3-7
postgresql-13 (Ubuntu package) - addressed in versions 13.5-0ubuntu0.21.04.1, 13.5-0ubuntu0.21.10.1
postgresql13-docs - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-server-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-server - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-pltcl-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-pltcl - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-plpython-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-plpython - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-plperl-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-plperl - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-debugsource - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-devel - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-devel-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-server-devel - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-server-devel-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13 - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-contrib - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-contrib-debuginfo - addressed in versions 13.5-3.15.2, 13.5-5.22.1
postgresql13-test - update to 13.5-5.22.1
postgresql13-llvmjit - update to 13.5-5.22.1
postgresql13-llvmjit-debuginfo - update to 13.5-5.22.1
postgresql14-server-devel - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-docs - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-devel-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-server-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-server - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-pltcl-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-devel - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-debugsource - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-server-devel-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
libpq5-debuginfo-32bit - update to 14.1-3.3.1
postgresql14-pltcl - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14 - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-contrib - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-contrib-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-plperl - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-plperl-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-plpython - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-plpython-debuginfo - addressed in versions 14.1-3.3.1, 14.1-5.6.1
postgresql14-llvmjit - update to 14.1-5.6.1
postgresql14-llvmjit-debuginfo - update to 14.1-5.6.1
postgresql14-test - update to 14.1-5.6.1

External References

Related Security Bulletins