CVE-2021-23222

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL constructs (including transactions, subselects and user-defined types and functions). The postgresql package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server.

Security Fix(es):

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.(CVE-2021-23214)

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.(CVE-2021-23222)

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.(CVE-2021-23214)

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.(CVE-2021-23222)

PostgreSQL is a powerful, open source object-relational database system that uses and extends the SQL language combined with many features that safely store and scale the most complicated data workloads. This package provides the essential shared library for any PostgreSQL client program or interface.

Security Fix(es):

A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.(CVE-2021-3677)

A man-in-the-middle attacker can inject false responses to the client s first few queries, despite the use of SSL certificate verification and encryption.(CVE-2021-23222)

A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.(CVE-2021-32028)

PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL constructs (including transactions, subselects and user-defined types and functions). The postgresql package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server.

Security Fix(es):

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.(CVE-2021-23214)

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.(CVE-2021-23222)

The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers.

Security Fix(es):

• postgresql: libpq processes unencrypted bytes from man-in-the-middle (CVE-2021-23222)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers.

Security Fix(es):

• postgresql: libpq processes unencrypted bytes from man-in-the-middle (CVE-2021-23222)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

• SECURITY UPDATE: A man-in-the-middle attacker can inject false responses
  • debian/patches/CVE-2021-23222.patch: libpq: reject extraneous data after SSL or GSS encryption handshake
  • CVE-2021-23222

Server processes unencrypted bytes from man-in-the-middle. (CVE-2021-23214)

libpq processes unencrypted bytes from man-in-the-middle. (CVE-2021-23222)

This update for postgresql10 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for postgresql12 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql14 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

• Let rpmlint ignore shlib-policy-name-error (boo#1191782).

This update for postgresql13 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql10 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

These are all security issues fixed in the postgresql10-10.19-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql11-11.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql12-12.9-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql13-13.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libecpg6-14.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql15-15.4-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql16-16.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql17-17.6-2.1 package on the GA media of openSUSE Tumbleweed.

This update for postgresql, postgresql13 and postgresql14 fixes the following issues:

Security issues fixed:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update also ships postgresql14 to SUSE Linux Enterprise 12 SP5. (jsc#SLE-22673) On older service packs only libpq5 and libecpg6 are being replaced by the postgresql14 variants.

Feature changes in postgresql14:

• https://www.postgresql.org/about/news/postgresql-14-released-2318/
• https://www.postgresql.org/docs/14/release-14.html

This update for postgresql96 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql12 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql14 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

• Let rpmlint ignore shlib-policy-name-error (boo#1191782).

This update for postgresql12 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql10 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql13 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql10 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql10 fixes the following issues:

• Upgrade to 10.22:

• CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension (bsc#1202368).

• Upgrade to 10.21:

• CVE-2022-1552: Confined additional operations within 'security restricted operation' sandboxes (bsc#1199475).

• Upgrade to 10.20 (bsc#1195680)

• Add constraints file with 12GB of memory for s390x as a workaround (boo#1190740)

• Upgrade to version 10.19 (bsc#1192516):

• CVE-2021-23214: Made the server reject extraneous data after an SSL or GSS encryption handshake

• CVE-2021-23222: Made libpq reject extraneous data after an SSL or GSS encryption handshake

• Fix for build with llvm12 on s390x. (bsc#1185952)

• Re-enable 'icu' for PostgreSQL 10. (bsc#1179945)

• Add postgresqlXX-server-devel as a dependency for postgresql13-server-devel. (bsc#1187751)

• Upgrade to version 10.18. (bsc#1190177)

This update for postgresql12 fixes the following issues:

• Upgrade to 12.12:

• CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension (bsc#1202368).

• Upgrade to 12.11:

• CVE-2022-1552: Confined additional operations within 'security restricted operation' sandboxes (bsc#1199475).

• Upgrade to 12.10 (bsc#1195680)

• Add constraints file with 12GB of memory for s390x as a workaround (boo#1190740)

• Upgrade to version 12.9 (bsc#1192516):

• CVE-2021-23214: Made the server reject extraneous data after an SSL or GSS encryption handshake

• CVE-2021-23222: Made libpq reject extraneous data after an SSL or GSS encryption handshake

• Upgrade to version 12.8:

• CVE-2021-3677: Fixed memory disclosure in certain queries (bsc#1189748).

• Upgrade to version 12.7:

• CVE-2021-32027: Fixed integer overflows in array subscripting calculations (bsc#1185924).

• CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists (bsc#1185925).

• CVE-2021-32029: Fixed possibly-incorrect computation of UPDATE ... RETURNING 'pg_psql_temporary_savepoint' does not exist (bsc#1185926).

• Fixed build with llvm12 on s390x (bsc#1185952).

• Re-enabled icu for PostgreSQL 10 (bsc#1179945).

• Made the dependency of postgresqlXX-server-devel on llvm and clang optional (bsc#1187751).

• llvm12 breaks PostgreSQL 11 and 12 on s390x. Use llvm11 as a workaround (bsc#1185952).

• Don't use %_stop_on_removal, because it was meant to be private and got removed from openSUSE. %_restart_on_update is also private, but still supported and needed for now (bsc#1183168).

Jacob Champion discovered that PostgreSQL incorrectly handled SSL certificate verification and encryption. A remote attacker could possibly use this issue to inject arbitrary SQL queries when a connection is first established.

Jacob Champion discovered that PostgreSQL incorrectly handled SSL certificate verification and encryption. A remote attacker could possibly use this issue to inject arbitrary SQL queries when a connection is first established.