CVE-2021-23214

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-23214
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-23214.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-23214
Aliases
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CLEANSTART (5)
CLSA (2)
DEBIAN (1)
ECHO (1)
JLSEC (1)
MGASA (1)
OESA (3)
openSUSE (13)
RHSA (5)
RLSA (3)
SUSE (10)
UBUNTU (1)
Related
ALSA (3)
openSUSE (13)
SUSE (10)
Published
2022-03-04T16:15:08Z
Modified
2026-07-23T08:16:27Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "fixed":  "9.6.24"
                },
                {
                    "introduced":  "10.0"
                },
                {
                    "fixed":  "10.19"
                },
                {
                    "introduced":  "11.0"
                },
                {
                    "fixed":  "11.14"
                },
                {
                    "introduced":  "12.0"
                },
                {
                    "fixed":  "12.9"
                },
                {
                    "introduced":  "13.0"
                },
                {
                    "fixed":  "13.5"
                }
            ],
            "source":  "CPE_RANGE",
            "vendor_product":  "postgresql:postgresql"
        },
        {
            "cpes":  [
                "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "34"
                },
                {
                    "last_affected":  "34"
                },
                {
                    "introduced":  "35"
                },
                {
                    "last_affected":  "35"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "fedoraproject:fedora"
        },
        {
            "cpes":  [
                "cpe:2.3:a:postgresql:postgresql:14.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "14.0"
                },
                {
                    "last_affected":  "14.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "postgresql:postgresql"
        },
        {
            "cpes":  [
                "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "8.0"
                },
                {
                    "last_affected":  "8.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "redhat:enterprise_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "8.0"
                },
                {
                    "last_affected":  "8.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "redhat:enterprise_linux_for_ibm_z_systems"
        },
        {
            "cpes":  [
                "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "8.0"
                },
                {
                    "last_affected":  "8.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "redhat:enterprise_linux_for_power_little_endian"
        },
        {
            "cpes":  [
                "cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "1.0"
                },
                {
                    "last_affected":  "1.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "redhat:software_collections"
        }
    ]
}
References

Affected packages

Git / github.com/postgres/postgres

Affected ranges

Type
GIT
Repo
https://github.com/postgres/postgres
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
28e24125541545483093819efae9bca603441951
Database specific
Show details 
{
    "source":  "REFERENCES"
}

Affected versions

Other
PG95-1_01
REL6_1
REL6_1_1
REL6_2
REL6_2_1
REL6_3
REL6_3_2
REL6_5
REL7_0
REL7_1
REL7_1_BETA
REL7_1_BETA2
REL7_1_BETA3
REL7_2
REL7_2_BETA1
REL7_2_BETA2
REL7_2_BETA3
REL7_2_BETA4
REL7_2_BETA5
REL7_2_RC1
REL7_2_RC2
REL7_4_BETA1
REL7_4_BETA2
REL7_4_BETA3
REL7_4_BETA4
REL7_4_BETA5
REL7_4_RC1
REL8_0_0
REL8_0_0BETA1
REL8_0_0BETA2
REL8_0_0BETA3
REL8_0_0BETA4
REL8_0_0BETA5
REL8_0_0RC1
REL8_0_0RC2
REL8_0_0RC3
REL8_0_0RC4
REL8_0_0RC5
REL8_1_0
REL8_1_0BETA1
REL8_1_0BETA2
REL8_1_0BETA3
REL8_1_0BETA4
REL8_1_0RC1
REL8_2_0
REL8_2_BETA1
REL8_2_BETA2
REL8_2_BETA3
REL8_2_RC1
REL8_3_0
REL8_3_BETA1
REL8_3_BETA2
REL8_3_BETA3
REL8_3_BETA4
REL8_3_RC1
REL8_3_RC2
REL8_4_0
REL8_4_BETA1
REL8_4_BETA2
REL8_4_RC1
REL8_4_RC2
REL9_0_ALPHA5
REL9_0_BETA1
REL9_0_BETA2
REL9_0_BETA3
REL9_1_ALPHA1
REL9_1_ALPHA2
REL9_1_ALPHA3
REL9_1_ALPHA4
REL9_1_ALPHA5
REL9_1_BETA1
REL9_1_BETA2
REL9_2_BETA1
REL9_2_BETA2
REL9_3_BETA1
REL9_4_BETA1
REL9_5_ALPHA1
REL9_6_BETA1
REL9_6_BETA2
REL9_6_BETA3
REL9_6_BETA4
REL_10_BETA1
REL_10_BETA2
REL_10_BETA3
REL_11_BETA1
REL_11_BETA2
REL_12_BETA1
REL_12_BETA2
REL_13_BETA1
REL_14_BETA1
REL_14_BETA2
Release_1_0_2
Release_2_0
Release_2_0_0
release-6-3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-23214.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "3811890202093623500044753568135729362",
            "length":  6502
        },
        "id":  "CVE-2021-23214-105eea8c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951",
        "target":  {
            "file":  "src/backend/postmaster/postmaster.c",
            "function":  "ProcessStartupPacket"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "144879391767781558536346253203041229101",
                "143909272608489929547646403088676984859",
                "165740410277193971204068639552488249268",
                "152409958841785490640372562688845117313",
                "234706297917235548429385406617794107408",
                "11828208314494370596831837586978750783"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-23214-55642aa1",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951",
        "target":  {
            "file":  "src/backend/postmaster/postmaster.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "257279594944366299067624145088475835974",
                "188038483610294623053840785400255306180",
                "333524964208957746553278214859551397688"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-23214-a802c310",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951",
        "target":  {
            "file":  "src/backend/libpq/pqcomm.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "269875017630651410691849837907292701499",
                "126933090860823315927436042326420265172",
                "127112800835486014972045098290616986500",
                "168426345693575339352762023412076698426"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-23214-ee44c440",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951",
        "target":  {
            "file":  "src/include/libpq/libpq.h"
        }
    }
]
vanir_signatures_modified 
"2026-07-23T08:16:27Z"