BIT-postgresql-2021-43767

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/postgresql/BIT-postgresql-2021-43767.json
JSON Data
https://api.test.osv.dev/v1/vulns/BIT-postgresql-2021-43767
Aliases
Published
2024-03-06T11:04:15.682Z
Modified
2024-03-06T11:25:28.861Z
Summary
[none]
Details

Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's first few queries. Despite the use of SSL certificate verification and encryption, Odyssey will pass these results to client as if they originated from valid server. This is similar to CVE-2021-23222 for PostgreSQL.

Database specific
{
    "cpes": [
        "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:postgresql:postgresql:14.0:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / postgresql

Package

Name
postgresql
Purl
pkg:bitnami/postgresql

Severity

  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
9.6.0
Fixed
9.6.24
Introduced
10.0.0
Fixed
10.19.0
Introduced
11.0.0
Fixed
11.14.0
Introduced
12.0.0
Fixed
12.9.0
Introduced
13.0.0
Fixed
13.5.0
Type
SEMVER
Events
Introduced
14.0.0
Last affected
14.0.0