CVE-2021-43767

 

Published at: - 25-08-2022 08:15

Last modified: - 31-08-2022 06:57

Total changes: - 2

Description

Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's first few queries. Despite the use of SSL certificate verification and encryption, Odyssey will pass these results to client as if they originated from valid server. This is similar to CVE-2021-23222 for PostgreSQL.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

 

Verification logic

 

Reference

• https://github.com/yandex/odyssey/issues/377,
• https://www.postgresql.org/support/security/CVE-2021-23222/

 

Keywords

NVD

 

CVE-2021-43767

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures