CVE-2023-31136
PostgresNIO processes unencrypted bytes from man-in-the-middle
Severity Score
5.9
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-04-24 CVE Reserved
- 2023-05-09 CVE Published
- 2024-08-02 CVE Updated
- 2024-10-19 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-522: Insufficiently Protected Credentials
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| https://github.com/advisories/GHSA-467w-rrqc-395f | Not Applicable | |
| https://github.com/advisories/GHSA-735f-7qx4-jqq5 | Not Applicable | |
| https://github.com/vapor/postgres-nio/releases/tag/1.14.2 | Release Notes | |
| https://www.postgresql.org/support/security/CVE-2021-23214 | Not Applicable | |
| https://www.postgresql.org/support/security/CVE-2021-23222 | Not Applicable |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/apple/swift-nio/pull/2419 | 2023-05-16 | |
| https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7 | 2023-05-16 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv | 2023-05-16 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Vapor Search vendor "Vapor" | Postgresnio Search vendor "Vapor" for product "Postgresnio" | < 1.14.2 Search vendor "Vapor" for product "Postgresnio" and version " < 1.14.2" | postgresql |
Affected
| ||||||