The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's first few queries. Despite the use of SSL certificate verification and encryption, Odyssey will pass these results to client as if they originated from valid server. This is similar to CVE-2021-23222 for PostgreSQL.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-pltclUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-plpython | Feb 9, 2023 | Aug 25, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub