Vulnerability CVE-2021-23222: Information

Description

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

Severity: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2021-23222
Published: March 3, 2022
Modified: Nov. 7, 2023
Error type identifier: CWE-522

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
postgresql10p1010.19-alt110.23-alt1.p10.1ALT-PU-2021-3345-1289311Fixed
postgresql10p910.19-alt0.M90P.110.23-alt0.M90P.1ALT-PU-2021-3462-1289302Fixed
postgresql10p9_e2k10.19-alt0.M90P.1.E2K.110.19-alt0.M90P.1.E2K.1ALT-PU-2022-3858-1-Fixed
postgresql10p810.19-alt0.M80P.110.19-alt0.M80P.1ALT-PU-2021-3578-1289365Fixed
postgresql10c10f110.19-alt110.23-alt1ALT-PU-2021-3345-1289311Fixed
postgresql10c9f210.19-alt0.M90P.110.23-alt0.M90P.1ALT-PU-2021-3566-1292243Fixed
postgresql11p1011.14-alt111.22-alt0.p10.1ALT-PU-2021-3346-1289311Fixed
postgresql11p911.14-alt0.M90P.111.22-alt0.M90P.1ALT-PU-2021-3463-1289302Fixed
postgresql11p9_e2k11.14-alt0.M90P.1.E2K.111.14-alt0.M90P.1.E2K.1ALT-PU-2022-3859-1-Fixed
postgresql11p811.14-alt0.M80P.111.14-alt0.M80P.1ALT-PU-2021-3579-1289365Fixed
postgresql11c10f111.14-alt111.22-alt0.p10.1ALT-PU-2021-3346-1289311Fixed
postgresql11c9f211.14-alt0.M90P.111.22-alt0.M90P.1ALT-PU-2021-3567-1292243Fixed
postgresql11-1Cp811.12-alt0.M80P.211.12-alt0.M80P.2ALT-PU-2021-3580-1289365Fixed
postgresql12sisyphus12.9-alt112.19-alt3ALT-PU-2021-3253-1289288Fixed
postgresql12sisyphus_e2k12.9-alt1.E2K.112.19-alt1ALT-PU-2021-4388-1-Fixed
postgresql12p1012.9-alt112.19-alt0.p10.1ALT-PU-2021-3347-1289311Fixed
postgresql12p912.9-alt0.M90P.112.18-alt0.M90P.1ALT-PU-2021-3459-1289302Fixed
postgresql12p9_e2k12.9-alt0.M90P.1.E2K.112.9-alt0.M90P.1.E2K.1ALT-PU-2022-3860-1-Fixed
postgresql12p812.9-alt0.M80P.112.9-alt0.M80P.1ALT-PU-2021-3581-1289365Fixed
postgresql12c10f112.9-alt112.19-alt0.p10.1ALT-PU-2021-3347-1289311Fixed
postgresql12c9f212.9-alt0.M90P.112.18-alt0.c9f2.1ALT-PU-2021-3600-1292389Fixed
postgresql12p1112.9-alt112.19-alt1ALT-PU-2021-3253-1289288Fixed
postgresql12-1Cp912.7-alt0.M90P.312.17-alt0.M90P.2ALT-PU-2021-3460-1289302Fixed
postgresql12-1Cp9_e2k12.7-alt0.M90P.3.E2K.112.7-alt0.M90P.3.E2K.1ALT-PU-2022-3861-1-Fixed
postgresql12-1Cc9f212.7-alt0.M90P.312.17-alt0.c9f2.2ALT-PU-2021-3564-1292243Fixed
postgresql13sisyphus13.5-alt113.15-alt3ALT-PU-2021-3254-1289288Fixed
postgresql13sisyphus_e2k13.5-alt1.E2K.113.15-alt1ALT-PU-2021-4387-1-Fixed
postgresql13p1013.5-alt113.15-alt0.p10.1ALT-PU-2021-3348-1289311Fixed
postgresql13c10f113.5-alt113.15-alt0.p10.1ALT-PU-2021-3348-1289311Fixed
postgresql13p1113.5-alt113.15-alt1ALT-PU-2021-3254-1289288Fixed
postgresql14sisyphus14.1-alt114.12-alt3ALT-PU-2021-3250-1289288Fixed
postgresql14p1014.1-alt114.12-alt0.p10.1ALT-PU-2021-3250-1289288Fixed
postgresql14p1114.1-alt114.12-alt1ALT-PU-2021-3250-1289288Fixed
postgresql9.6p99.6.24-alt0.M90P.19.6.24-alt0.M90P.1ALT-PU-2021-3461-1289302Fixed
postgresql9.6p9_e2k9.6.24-alt0.M90P.1.E2K.19.6.24-alt0.M90P.1.E2K.1ALT-PU-2022-3857-1-Fixed
postgresql9.6p89.6.24-alt0.M80P.19.6.24-alt0.M80P.1ALT-PU-2021-3577-1289365Fixed
postgresql9.6c9f29.6.24-alt0.M90P.19.6.24-alt0.M90P.1ALT-PU-2021-3565-1292243Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://github.com/postgres/postgres/commit/160c0258802d10b0600d7671b1bbea55d8e17d45
  • Patch
  • Third Party Advisory
https://www.postgresql.org/support/security/CVE-2021-23222/
  • Release Notes
  • Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2022675
  • Issue Tracking
  • Third Party Advisory
GLSA-202211-04
  • Third Party Advisory
https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commitdiff%3Bh=d83cdfdca9d918bbbd6bb209139b94c954da7228

      1. Configuration 1

        cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
        Start including
        9.6
        End excliding
        9.6.24
        cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
        Start including
        10.0
        End excliding
        10.19
        cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
        Start including
        11.0
        End excliding
        11.14
        cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
        Start including
        12.0
        End excliding
        12.9
        cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
        Start including
        13.0
        End excliding
        13.5
        cpe:2.3:a:postgresql:postgresql:14.0:*:*:*:*:*:*:*
    VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
    Version: v24.5.2
    Back to top