When the EDB Postgres Advanced Server with IBM, IBM Data Management Platform for EDB Postgres Standard for IBM Cloud Pak for Data, and IBM Data Management Platform for EDB Postgres Enterprise for IBM Cloud Pak for Data are configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.
CVEID:CVE-2021-23214
**DESCRIPTION:**PostgreSQL is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements when the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, which could allow the attacker to view, add, modify or delete information in the back-end database.
CVSS Base score: 8.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/213379 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Product(s) | Version(s) |
---|---|
EDB Postgres Advanced Server with IBM | 13.1 |
IBM Data Management Platform for EDB Postgres Standard for IBM Cloud Pak for Data | 2.0, 4.0.x |
IBM Data Management Platform for EDB Postgres Enterprise for IBM Cloud Pak for Data | 2.0, 4.0.x |
Affected version | Version | Remediation/Fix/Instructions |
---|---|---|
EDB Postgres Advanced Server with IBM | 13.1 | Download v13.5 and install |
IBM Data Management Platform for EDB Postgres Standard for IBM Cloud Pak for Data | 2.0, 4.0.x | Upgrade to version 4.0.4 via the steps outlined in the Cloud Pak for Data Documentation. |
IBM Data Management Platform for EDB Postgres Enterprise for IBM Cloud Pak for Data | 2.0, 4.0.x | Upgrade to version 4.0.4 via the steps outlined in the Cloud Pak for Data Documentation. |
IBM strongly recommends addressing the vulnerability now by upgrading to EDB Postgres Advanced Server with IBM v13.5 and upgrading IBM Data Management Platform for EDB Postgres (Standard or Enterprise) for IBM Cloud Pak for Data to version 4.0.4.