5.9

CVE-2023-31136

PostgresNIO processes unencrypted bytes from man-in-the-middle

PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Vapor ≫ Postgresnio SwPlatformpostgresql Version < 1.14.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.49% 0.382
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
security-advisories@github.com 3.7 2.2 1.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

https://www.postgresql.org/support/security/CVE-2021-23222/
Not Applicable
https://www.postgresql.org/support/security/CVE-2021-23214/
Not Applicable
https://github.com/advisories/GHSA-467w-rrqc-395f
Not Applicable
https://github.com/advisories/GHSA-735f-7qx4-jqq5
Not Applicable
https://github.com/apple/swift-nio/pull/2419
Patch
https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7
Patch
https://github.com/vapor/postgres-nio/releases/tag/1.14.2
Release Notes
https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv
Vendor Advisory