High
Security advisory
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-23214
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:37 UTC · Revision 1
Source evidence
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.
osv:CVE-2021-23214
Complete source record
{
"id": "e527cafa158ae9ab8950d6e676655bc15f562778b7fb4b332bda84dcfc86c616",
"url": "https://osv.dev/vulnerability/CVE-2021-23214",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-23214",
"summary": "When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.",
"evidence": "osv:CVE-2021-23214",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-23214",
"aliases": [
"BIT-postgresql-2021-23214",
"CVE-2021-23214"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/postgres/postgres",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "a4116b8d5a4f68803452d8f1aa3f74f302049a90"
},
{
"introduced": "5df0e99bea1c3e5fbffa7fbd0982da88ea149bb6"
},
{
"fixed": "477008d10fb5a024038ed23f0beba901f1f47ae2"
},
{
"introduced": "19f20081df059fef87e14c8e953669bd173dd7f1"
},
{
"fixed": "7f05af399052dab32c28c253fa891dc1e8b4224b"
},
{
"introduced": "ad1f2885b8c82e0c2d56d7974f012cbecce17a17"
},
{
"fixed": "8a94efd9bb71c2d5473836ce4899aedb9b4cfb2e"
},
{
"introduced": "29be9983a64c011eac0b9ee29895cce71e15ea77"
},
{
"fixed": "084346ccee8ead6b387a90cdf6a29036ae9ec77e"
},
{
"introduced": "86a4dc1e6f29d1992a2afa3fac1a0b0a6e84568c"
},
{
"last_affected": "c22b7eccd368754ea96865c046764382ab05db4b"
},
{
"fixed": "28e24125541545483093819efae9bca603441951"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "9.6.24"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0"
},
{
"fixed": "10.19"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0"
},
{
"fixed": "11.14"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "12.0"
},
{
"fixed": "12.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "13.0"
},
{
"fixed": "13.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:postgresql:postgresql:14.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "14.0"
},
{
"last_affected": "14.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0"
},
{
"last_affected": "1.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "28e24125541545483093819efae9bca603441951"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"1.0",
"14.0",
"8.0",
"REL_13_4",
"REL_12_8",
"REL_11_13",
"REL_10_18",
"REL_10_17",
"REL_11_12",
"REL_12_7",
"REL_13_3",
"REL_10_16",
"REL_11_11",
"REL_12_6",
"REL_13_2",
"REL_10_15",
"REL_11_10",
"REL_12_5",
"REL_13_1",
"REL_13_0",
"REL_10_14",
"REL_11_9",
"REL_12_4",
"REL_10_13",
"REL_11_8",
"REL_12_3",
"REL_10_12",
"REL_11_7",
"REL_12_2",
"REL_10_11",
"REL_11_6",
"REL_12_1",
"REL_12_0",
"REL_10_10",
"REL_11_5",
"REL_10_9",
"REL_11_4",
"REL_10_8",
"REL_11_3",
"REL_10_7",
"REL_11_2",
"REL_11_1",
"REL_10_6",
"REL_11_0",
"REL_10_5",
"REL_10_4",
"REL_10_3",
"REL_10_2",
"REL_10_1",
"REL_10_0",
"REL8_0_0",
"REL8_0_0RC5",
"REL8_0_0RC4",
"REL8_0_0RC3",
"REL8_0_0RC2",
"REL8_0_0RC1",
"REL8_0_0BETA5",
"REL8_0_0BETA4",
"REL8_0_0BETA3",
"REL8_0_0BETA2",
"REL8_0_0BETA1",
"REL7_4_RC1",
"REL7_4_BETA5",
"REL7_4_BETA4",
"REL7_4_BETA3",
"REL7_4_BETA2",
"REL7_4_BETA1",
"REL7_2",
"REL7_2_RC2",
"REL7_2_RC1",
"REL7_2_BETA5",
"REL7_2_BETA4",
"REL7_2_BETA3",
"REL7_2_BETA2",
"REL7_2_BETA1",
"REL7_1",
"REL7_1_BETA3",
"REL7_1_BETA2",
"REL7_1_BETA",
"REL7_0",
"REL6_5",
"REL6_3_2",
"release-6-3",
"REL6_3",
"REL6_2_1",
"REL6_2",
"REL6_1_1",
"REL6_1",
"Release_2_0_0",
"Release_1_0_2",
"Release_2_0",
"PG95-1_01"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23214.json",
"vanir_signatures": [
{
"id": "CVE-2021-23214-105eea8c",
"digest": {
"length": 6502,
"function_hash": "3811890202093623500044753568135729362"
},
"source": "https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951",
"target": {
"file": "src/backend/postmaster/postmaster.c",
"function": "ProcessStartupPacket"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-23214-55642aa1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"144879391767781558536346253203041229101",
"143909272608489929547646403088676984859",
"165740410277193971204068639552488249268",
"152409958841785490640372562688845117313",
"234706297917235548429385406617794107408",
"11828208314494370596831837586978750783"
]
},
"source": "https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951",
"target": {
"file": "src/backend/postmaster/postmaster.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-23214-a802c310",
"digest": {
"threshold": 0.9,
"line_hashes": [
"257279594944366299067624145088475835974",
"188038483610294623053840785400255306180",
"333524964208957746553278214859551397688"
]
},
"source": "https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951",
"target": {
"file": "src/backend/libpq/pqcomm.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-23214-ee44c440",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269875017630651410691849837907292701499",
"126933090860823315927436042326420265172",
"127112800835486014972045098290616986500",
"168426345693575339352762023412076698426"
]
},
"source": "https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951",
"target": {
"file": "src/include/libpq/libpq.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:06:40Z"
}
}
],
"modified": "2026-10-20T14:06:40.563242287Z",
"provider": "osv",
"references": [
"https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commit%3Bh=28e24125541545483093819efae9bca603441951",
"https://security.gentoo.org/glsa/202211-04",
"https://www.postgresql.org/support/security/CVE-2021-23214/",
"https://bugzilla.redhat.com/show_bug.cgi?id=2022666",
"https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "34"
},
{
"last_affected": "34"
},
{
"introduced": "35"
},
{
"last_affected": "35"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-23214",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388560,
"published_at": "2022-03-04T16:15:08.293+00:00"
}