CVE-2023-31136

PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/advisories/GHSA-467w-rrqc-395f	Not Applicable
https://github.com/advisories/GHSA-735f-7qx4-jqq5	Not Applicable
https://github.com/apple/swift-nio/pull/2419	Patch
https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7	Patch
https://github.com/vapor/postgres-nio/releases/tag/1.14.2	Release Notes
https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv	Vendor Advisory
https://www.postgresql.org/support/security/CVE-2021-23214/	Not Applicable
https://www.postgresql.org/support/security/CVE-2021-23222/	Not Applicable
https://github.com/advisories/GHSA-467w-rrqc-395f	Not Applicable
https://github.com/advisories/GHSA-735f-7qx4-jqq5	Not Applicable
https://github.com/apple/swift-nio/pull/2419	Patch
https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7	Patch
https://github.com/vapor/postgres-nio/releases/tag/1.14.2	Release Notes
https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv	Vendor Advisory
https://www.postgresql.org/support/security/CVE-2021-23214/	Not Applicable
https://www.postgresql.org/support/security/CVE-2021-23222/	Not Applicable

Configurations

Configuration 1 (hide)

cpe:2.3:a:vapor:postgresnio:*:*:*:*:*:postgresql:*:*

History

No history.

Information

Published : 2023-05-09 14:15

Updated : 2024-11-21 08:01

NVD link : CVE-2023-31136

Mitre link : CVE-2023-31136

CVE.ORG link : CVE-2023-31136

JSON object : View

Products Affected

vapor

postgresnio

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2023-31136", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2023-05-09T14:15:13.520", "references": [{"url": "https://github.com/advisories/GHSA-467w-rrqc-395f", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}, {"url": "https://github.com/advisories/GHSA-735f-7qx4-jqq5", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}, {"url": "https://github.com/apple/swift-nio/pull/2419", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vapor/postgres-nio/releases/tag/1.14.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.postgresql.org/support/security/CVE-2021-23214/", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}, {"url": "https://www.postgresql.org/support/security/CVE-2021-23222/", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}, {"url": "https://github.com/advisories/GHSA-467w-rrqc-395f", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/advisories/GHSA-735f-7qx4-jqq5", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/apple/swift-nio/pull/2419", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/vapor/postgres-nio/releases/tag/1.14.2", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.postgresql.org/support/security/CVE-2021-23214/", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.postgresql.org/support/security/CVE-2021-23222/", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users."}], "lastModified": "2024-11-21T08:01:28.043", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vapor:postgresnio:*:*:*:*:*:postgresql:*:*", "vulnerable": true, "matchCriteriaId": "F30C6121-3F39-47E8-8EDF-DB10D6A63BDB", "versionEndExcluding": "1.14.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}