CVE-2023-31136

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-31136
PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/advisories/GHSA-467w-rrqc-395f Not Applicable
https://github.com/advisories/GHSA-735f-7qx4-jqq5 Not Applicable
https://github.com/apple/swift-nio/pull/2419 Patch
https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7 Patch
https://github.com/vapor/postgres-nio/releases/tag/1.14.2 Release Notes
https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv Vendor Advisory
https://www.postgresql.org/support/security/CVE-2021-23214/ Not Applicable
https://www.postgresql.org/support/security/CVE-2021-23222/ Not Applicable
Configurations

Configuration 1 (hide)

cpe:2.3:a:vapor:postgresnio:*:*:*:*:*:postgresql:*:*
History

16 May 2023, 16:43

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.9
First Time Vapor postgresnio
Vapor
References (MISC) https://github.com/apple/swift-nio/pull/2419 - (MISC) https://github.com/apple/swift-nio/pull/2419 - Patch
References (MISC) https://github.com/advisories/GHSA-467w-rrqc-395f - (MISC) https://github.com/advisories/GHSA-467w-rrqc-395f - Not Applicable
References (MISC) https://www.postgresql.org/support/security/CVE-2021-23214/ - (MISC) https://www.postgresql.org/support/security/CVE-2021-23214/ - Not Applicable
References (MISC) https://github.com/advisories/GHSA-735f-7qx4-jqq5 - (MISC) https://github.com/advisories/GHSA-735f-7qx4-jqq5 - Not Applicable
References (MISC) https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7 - (MISC) https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7 - Patch
References (MISC) https://www.postgresql.org/support/security/CVE-2021-23222/ - (MISC) https://www.postgresql.org/support/security/CVE-2021-23222/ - Not Applicable
References (MISC) https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv - (MISC) https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv - Vendor Advisory
References (MISC) https://github.com/vapor/postgres-nio/releases/tag/1.14.2 - (MISC) https://github.com/vapor/postgres-nio/releases/tag/1.14.2 - Release Notes
CPE cpe:2.3:a:vapor:postgresnio:*:*:*:*:*:postgresql:*:*

09 May 2023, 14:30

Type Values Removed Values Added
New CVE
Information

Published : 2023-05-09 14:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-31136

Mitre link : CVE-2023-31136

CVE.ORG link : CVE-2023-31136

JSON object : View

Products Affected

vapor

  • postgresnio
CWE
CWE-522

Insufficiently Protected Credentials