Rapid7 Vulnerability & Exploit Database

Huawei EulerOS: CVE-2021-43767: postgresql-10.5 security update

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

Huawei EulerOS: CVE-2021-43767: postgresql-10.5 security update

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
08/25/2022
Created
02/10/2023
Added
02/09/2023
Modified
02/09/2023

Description

Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's first few queries. Despite the use of SSL certificate verification and encryption, Odyssey will pass these results to client as if they originated from valid server. This is similar to CVE-2021-23222 for PostgreSQL.

Solution(s)

  • huawei-euleros-2_0_sp8-upgrade-postgresql
  • huawei-euleros-2_0_sp8-upgrade-postgresql-contrib
  • huawei-euleros-2_0_sp8-upgrade-postgresql-devel
  • huawei-euleros-2_0_sp8-upgrade-postgresql-docs
  • huawei-euleros-2_0_sp8-upgrade-postgresql-libs
  • huawei-euleros-2_0_sp8-upgrade-postgresql-plperl
  • huawei-euleros-2_0_sp8-upgrade-postgresql-plpython
  • huawei-euleros-2_0_sp8-upgrade-postgresql-pltcl
  • huawei-euleros-2_0_sp8-upgrade-postgresql-server
  • huawei-euleros-2_0_sp8-upgrade-postgresql-test

References

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;