CVE-2021-23214

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to the fixed version

Description The issue is related to a man-in-the-middle attack when the server is configured to use trust authentication with a clientcert requirement or to use cert authentication. This allows an attacker to inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. The vulnerability is associated with the lack of protection for the SQL query structure, which can enable a remote attacker to execute arbitrary code.

Recommendations For versions prior to the fixed version, consider disabling the use of trust authentication with a clientcert requirement or cert authentication until a patch is available. Restrict access to the SQL query structure to minimize the risk of exploitation. Avoid using unencrypted connections to prevent man-in-the-middle attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.