Vulnerability-Lookup

FKIE_CVE-2023-31136

Vulnerability from fkie_nvd - Published: 2023-05-09 14:15 - Updated: 2024-11-21 08:01

Severity ?

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users.

References

URL	Tags
security-advisories@github.com	https://github.com/advisories/GHSA-467w-rrqc-395f	Not Applicable
security-advisories@github.com	https://github.com/advisories/GHSA-735f-7qx4-jqq5	Not Applicable
security-advisories@github.com	https://github.com/apple/swift-nio/pull/2419	Patch
security-advisories@github.com	https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7	Patch
security-advisories@github.com	https://github.com/vapor/postgres-nio/releases/tag/1.14.2	Release Notes
security-advisories@github.com	https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv	Vendor Advisory
security-advisories@github.com	https://www.postgresql.org/support/security/CVE-2021-23214/	Not Applicable
security-advisories@github.com	https://www.postgresql.org/support/security/CVE-2021-23222/	Not Applicable
af854a3a-2127-422b-91ae-364da2661108	https://github.com/advisories/GHSA-467w-rrqc-395f	Not Applicable
af854a3a-2127-422b-91ae-364da2661108	https://github.com/advisories/GHSA-735f-7qx4-jqq5	Not Applicable
af854a3a-2127-422b-91ae-364da2661108	https://github.com/apple/swift-nio/pull/2419	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/vapor/postgres-nio/releases/tag/1.14.2	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.postgresql.org/support/security/CVE-2021-23214/	Not Applicable
af854a3a-2127-422b-91ae-364da2661108	https://www.postgresql.org/support/security/CVE-2021-23222/	Not Applicable

Impacted products

	Vendor	Product	Version
	vapor	postgresnio	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vapor:postgresnio:*:*:*:*:*:postgresql:*:*",
              "matchCriteriaId": "F30C6121-3F39-47E8-8EDF-DB10D6A63BDB",
              "versionEndExcluding": "1.14.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client\u0027s first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users."
    }
  ],
  "id": "CVE-2023-31136",
  "lastModified": "2024-11-21T08:01:28.043",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-05-09T14:15:13.520",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://github.com/advisories/GHSA-467w-rrqc-395f"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://github.com/advisories/GHSA-735f-7qx4-jqq5"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/apple/swift-nio/pull/2419"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/vapor/postgres-nio/releases/tag/1.14.2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.postgresql.org/support/security/CVE-2021-23214/"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.postgresql.org/support/security/CVE-2021-23222/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://github.com/advisories/GHSA-467w-rrqc-395f"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://github.com/advisories/GHSA-735f-7qx4-jqq5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/apple/swift-nio/pull/2419"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/vapor/postgres-nio/releases/tag/1.14.2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.postgresql.org/support/security/CVE-2021-23214/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.postgresql.org/support/security/CVE-2021-23222/"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

CVE-2023-31136 (GCVE-0-2023-31136)

Vulnerability from cvelistv5 – Published: 2023-05-09 13:37 – Updated: 2025-01-28 17:05

Title

PostgresNIO processes unencrypted bytes from man-in-the-middle

Summary

Severity ?

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-522 - Insufficiently Protected Credentials

Assigner

GitHub_M

References

URL

Tags

	https://github.com/vapor/postgres-nio/security/ad…	x_refsource_CONFIRM
	https://github.com/apple/swift-nio/pull/2419	x_refsource_MISC
	https://github.com/vapor/postgres-nio/commit/2df5…	x_refsource_MISC
	https://github.com/advisories/GHSA-467w-rrqc-395f	x_refsource_MISC
	https://github.com/advisories/GHSA-735f-7qx4-jqq5	x_refsource_MISC
	https://github.com/vapor/postgres-nio/releases/ta…	x_refsource_MISC
	https://www.postgresql.org/support/security/CVE-2…	x_refsource_MISC
	https://www.postgresql.org/support/security/CVE-2…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	vapor	postgres-nio	Affected: < 1.14.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:45:25.783Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv"
          },
          {
            "name": "https://github.com/apple/swift-nio/pull/2419",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/apple/swift-nio/pull/2419"
          },
          {
            "name": "https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7"
          },
          {
            "name": "https://github.com/advisories/GHSA-467w-rrqc-395f",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/advisories/GHSA-467w-rrqc-395f"
          },
          {
            "name": "https://github.com/advisories/GHSA-735f-7qx4-jqq5",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/advisories/GHSA-735f-7qx4-jqq5"
          },
          {
            "name": "https://github.com/vapor/postgres-nio/releases/tag/1.14.2",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/vapor/postgres-nio/releases/tag/1.14.2"
          },
          {
            "name": "https://www.postgresql.org/support/security/CVE-2021-23214/",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.postgresql.org/support/security/CVE-2021-23214/"
          },
          {
            "name": "https://www.postgresql.org/support/security/CVE-2021-23222/",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.postgresql.org/support/security/CVE-2021-23222/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-31136",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-28T17:04:53.449827Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-28T17:05:03.749Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "postgres-nio",
          "vendor": "vapor",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.14.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client\u0027s first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-09T13:37:38.193Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv"
        },
        {
          "name": "https://github.com/apple/swift-nio/pull/2419",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apple/swift-nio/pull/2419"
        },
        {
          "name": "https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7"
        },
        {
          "name": "https://github.com/advisories/GHSA-467w-rrqc-395f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/advisories/GHSA-467w-rrqc-395f"
        },
        {
          "name": "https://github.com/advisories/GHSA-735f-7qx4-jqq5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/advisories/GHSA-735f-7qx4-jqq5"
        },
        {
          "name": "https://github.com/vapor/postgres-nio/releases/tag/1.14.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vapor/postgres-nio/releases/tag/1.14.2"
        },
        {
          "name": "https://www.postgresql.org/support/security/CVE-2021-23214/",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.postgresql.org/support/security/CVE-2021-23214/"
        },
        {
          "name": "https://www.postgresql.org/support/security/CVE-2021-23222/",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.postgresql.org/support/security/CVE-2021-23222/"
        }
      ],
      "source": {
        "advisory": "GHSA-9cfh-vx93-84vv",
        "discovery": "UNKNOWN"
      },
      "title": "PostgresNIO processes unencrypted bytes from man-in-the-middle"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-31136",
    "datePublished": "2023-05-09T13:37:38.193Z",
    "dateReserved": "2023-04-24T21:44:10.417Z",
    "dateUpdated": "2025-01-28T17:05:03.749Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2023-31136

CVE-2023-31136 (GCVE-0-2023-31136)

Tags

Sightings

Nomenclature