CVE-2021-23214

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL constructs (including transactions, subselects and user-defined types and functions). The postgresql package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server.

Security Fix(es):

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.(CVE-2021-23214)

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.(CVE-2021-23222)

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.(CVE-2021-23214)

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.(CVE-2021-23222)

PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL constructs (including transactions, subselects and user-defined types and functions). The postgresql package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server.

Security Fix(es):

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.(CVE-2021-23214)

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.(CVE-2021-23222)

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (12.9).

Security Fix(es):

• postgresql: memory disclosure in certain queries (CVE-2021-3677)

• postgresql: server processes unencrypted bytes from man-in-the-middle (CVE-2021-23214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (13.5).

Security Fix(es):

• postgresql: memory disclosure in certain queries (CVE-2021-3677)

• postgresql: server processes unencrypted bytes from man-in-the-middle (CVE-2021-23214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (10.19). (BZ#2023231)

Security Fix(es):

• postgresql: server processes unencrypted bytes from man-in-the-middle (CVE-2021-23214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (12.9).

Security Fix(es):

• postgresql: memory disclosure in certain queries (CVE-2021-3677)

• postgresql: server processes unencrypted bytes from man-in-the-middle (CVE-2021-23214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (13.5).

Security Fix(es):

• postgresql: memory disclosure in certain queries (CVE-2021-3677)

• postgresql: server processes unencrypted bytes from man-in-the-middle (CVE-2021-23214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (10.19). (BZ#2023231)

Security Fix(es):

• postgresql: server processes unencrypted bytes from man-in-the-middle (CVE-2021-23214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

• SECURITY UPDATE: MITM attack introducing arbitrary SQL quieries
  • debian/patches/CVE-2021-23214.patch: Raise error if data was received during SSL handshake
  • CVE-2021-23214

• CVE-2021-23214: Reject extraneous data after SSL or GSS encryption handshake

Server processes unencrypted bytes from man-in-the-middle. (CVE-2021-23214)

libpq processes unencrypted bytes from man-in-the-middle. (CVE-2021-23222)

This update for postgresql10 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for postgresql12 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql14 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

• Let rpmlint ignore shlib-policy-name-error (boo#1191782).

This update for postgresql13 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql10 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

These are all security issues fixed in the postgresql10-10.19-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql11-11.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql12-12.9-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql13-13.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libecpg6-14.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql15-15.4-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql16-16.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql17-17.6-2.1 package on the GA media of openSUSE Tumbleweed.

This update for postgresql, postgresql13 and postgresql14 fixes the following issues:

Security issues fixed:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update also ships postgresql14 to SUSE Linux Enterprise 12 SP5. (jsc#SLE-22673) On older service packs only libpq5 and libecpg6 are being replaced by the postgresql14 variants.

Feature changes in postgresql14:

• https://www.postgresql.org/about/news/postgresql-14-released-2318/
• https://www.postgresql.org/docs/14/release-14.html

This update for postgresql96 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql12 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql14 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

• Let rpmlint ignore shlib-policy-name-error (boo#1191782).

This update for postgresql12 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql10 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql13 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql10 fixes the following issues:

• CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
• CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update for postgresql10 fixes the following issues:

• Upgrade to 10.22:

• CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension (bsc#1202368).

• Upgrade to 10.21:

• CVE-2022-1552: Confined additional operations within 'security restricted operation' sandboxes (bsc#1199475).

• Upgrade to 10.20 (bsc#1195680)

• Add constraints file with 12GB of memory for s390x as a workaround (boo#1190740)

• Upgrade to version 10.19 (bsc#1192516):

• CVE-2021-23214: Made the server reject extraneous data after an SSL or GSS encryption handshake

• CVE-2021-23222: Made libpq reject extraneous data after an SSL or GSS encryption handshake

• Fix for build with llvm12 on s390x. (bsc#1185952)

• Re-enable 'icu' for PostgreSQL 10. (bsc#1179945)

• Add postgresqlXX-server-devel as a dependency for postgresql13-server-devel. (bsc#1187751)

• Upgrade to version 10.18. (bsc#1190177)