Medium
Security advisory
A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-23222
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:43 UTC · Revision 1
Source evidence
A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.
osv:CVE-2021-23222
Complete source record
{
"id": "968faa87e9a7c4b08c1f28cff8c120849539dc67fec6325f64d7ee17dfee9382",
"url": "https://osv.dev/vulnerability/CVE-2021-23222",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-23222",
"summary": "A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.",
"evidence": "osv:CVE-2021-23222",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-23222",
"aliases": [
"BIT-postgresql-2021-23222",
"CVE-2021-23222"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/postgres/postgres",
"type": "GIT",
"events": [
{
"introduced": "a721a1ba9cf6c86cb52f1bf325d5a27b64e870d6"
},
{
"fixed": "a4116b8d5a4f68803452d8f1aa3f74f302049a90"
},
{
"introduced": "5df0e99bea1c3e5fbffa7fbd0982da88ea149bb6"
},
{
"fixed": "477008d10fb5a024038ed23f0beba901f1f47ae2"
},
{
"introduced": "19f20081df059fef87e14c8e953669bd173dd7f1"
},
{
"fixed": "7f05af399052dab32c28c253fa891dc1e8b4224b"
},
{
"introduced": "ad1f2885b8c82e0c2d56d7974f012cbecce17a17"
},
{
"fixed": "8a94efd9bb71c2d5473836ce4899aedb9b4cfb2e"
},
{
"introduced": "29be9983a64c011eac0b9ee29895cce71e15ea77"
},
{
"fixed": "084346ccee8ead6b387a90cdf6a29036ae9ec77e"
},
{
"introduced": "86a4dc1e6f29d1992a2afa3fac1a0b0a6e84568c"
},
{
"last_affected": "86a4dc1e6f29d1992a2afa3fac1a0b0a6e84568c"
},
{
"fixed": "160c0258802d10b0600d7671b1bbea55d8e17d45"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.6"
},
{
"fixed": "9.6.24"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0"
},
{
"fixed": "10.19"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0"
},
{
"fixed": "11.14"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "12.0"
},
{
"fixed": "12.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "13.0"
},
{
"fixed": "13.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:postgresql:postgresql:14.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "14.0"
},
{
"last_affected": "14.0"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "160c0258802d10b0600d7671b1bbea55d8e17d45"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"14.0",
"REL_14_0",
"REL_13_4",
"REL_12_8",
"REL_11_13",
"REL_10_18",
"REL9_6_23",
"REL9_6_22",
"REL_10_17",
"REL_11_12",
"REL_12_7",
"REL_13_3",
"REL9_6_21",
"REL_10_16",
"REL_11_11",
"REL_12_6",
"REL_13_2",
"REL9_6_20",
"REL_10_15",
"REL_11_10",
"REL_12_5",
"REL_13_1",
"REL_13_0",
"REL9_6_19",
"REL_10_14",
"REL_11_9",
"REL_12_4",
"REL9_6_18",
"REL_10_13",
"REL_11_8",
"REL_12_3",
"REL9_6_17",
"REL_10_12",
"REL_11_7",
"REL_12_2",
"REL9_6_16",
"REL_10_11",
"REL_11_6",
"REL_12_1",
"REL_12_0",
"REL9_6_15",
"REL_10_10",
"REL_11_5",
"REL9_6_14",
"REL_10_9",
"REL_11_4",
"REL9_6_13",
"REL_10_8",
"REL_11_3",
"REL9_6_12",
"REL_10_7",
"REL_11_2",
"REL_11_1",
"REL9_6_11",
"REL_10_6",
"REL_11_0",
"REL9_6_10",
"REL_10_5",
"REL9_6_9",
"REL_10_4",
"REL9_6_8",
"REL_10_3",
"REL9_6_7",
"REL_10_2",
"REL9_6_6",
"REL_10_1",
"REL_10_0",
"REL9_6_5",
"REL9_6_4",
"REL9_6_3",
"REL9_6_2",
"REL9_6_1",
"REL9_6_0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23222.json",
"vanir_signatures": [
{
"id": "CVE-2021-23222-e1be026c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"10037443517696866748761392046871582022",
"325675312630126864791861414191520860108",
"248756423465337085234785710824740055381",
"219130724463359041405235398817575440371",
"18312600838351471896985731433715124179",
"29813103265162816138856506205737681509",
"248756423465337085234785710824740055381",
"219130724463359041405235398817575440371"
]
},
"source": "https://github.com/postgres/postgres/commit/160c0258802d10b0600d7671b1bbea55d8e17d45",
"target": {
"file": "src/interfaces/libpq/fe-connect.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-23222-f5ed594b",
"digest": {
"length": 22472,
"function_hash": "218920273742902448943626208937972612244"
},
"source": "https://github.com/postgres/postgres/commit/160c0258802d10b0600d7671b1bbea55d8e17d45",
"target": {
"file": "src/interfaces/libpq/fe-connect.c",
"function": "PQconnectPoll"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:23:30Z"
}
}
],
"modified": "2026-10-20T14:23:30.834099740Z",
"provider": "osv",
"references": [
"https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commitdiff%3Bh=d83cdfdca9d918bbbd6bb209139b94c954da7228",
"https://security.gentoo.org/glsa/202211-04",
"https://www.postgresql.org/support/security/CVE-2021-23222/",
"https://bugzilla.redhat.com/show_bug.cgi?id=2022675",
"https://github.com/postgres/postgres/commit/160c0258802d10b0600d7671b1bbea55d8e17d45"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-23222",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388873,
"published_at": "2022-03-02T23:15:08.517+00:00"
}