CVE-2021-23214

Published: 11 November 2021

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

Priority

Medium

CVSS 3 base score: 8.1

Status

Notes

PostgreSQL 9.3 is end of life upstream, and no updates are
are available. Marking as deferred in -esm-main releases.

Plan is for postgresql-13 to be removed from jammy, marking as
deferred for now.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23214
• https://www.postgresql.org/about/news/postgresql-141-135-129-1114-1019-and-9624-released-2349/
• https://ubuntu.com/security/notices/USN-5145-1
• NVD
• Launchpad
• Debian