Описание
When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1.
Ссылки
- Release NotesVendor Advisory
- Issue TrackingThird Party Advisory
- Mailing ListThird Party Advisory
- Release NotesVendor Advisory
- Issue TrackingThird Party Advisory
- Mailing ListThird Party Advisory
Уязвимые конфигурации
EPSS
8.1 High
CVSS3
5.1 Medium
CVSS2
Дефекты
Связанные уязвимости
When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1.
When PgBouncer is configured to use "cert" authentication a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1.
When PgBouncer is configured to use "cert" authentication, a man-in-th ...
When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1.
Уязвимость программы для пула соединения в PostgreSQL PgBouncer, связанная с непринятием мер по защите структуры SQL-запроса, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
EPSS
8.1 High
CVSS3
5.1 Medium
CVSS2