Skip to content
OpenAdvisories
Medium ALAS2-2023-1949 1 CVE

Moderate: postgresql security update (Amazon Linux 2)

Published Feb 17, 2023 · Updated Feb 22, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-23214: When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

Fixed packages 13

ReleasePackageFixed in
Amazon Linux · 2 postgresql 0:9.2.24-8.amzn2.0.1
Amazon Linux · 2 postgresql-contrib 0:9.2.24-8.amzn2.0.1
Amazon Linux · 2 postgresql-debuginfo 0:9.2.24-8.amzn2.0.1
Amazon Linux · 2 postgresql-devel 0:9.2.24-8.amzn2.0.1
Amazon Linux · 2 postgresql-docs 0:9.2.24-8.amzn2.0.1
Amazon Linux · 2 postgresql-libs 0:9.2.24-8.amzn2.0.1
Amazon Linux · 2 postgresql-plperl 0:9.2.24-8.amzn2.0.1
Amazon Linux · 2 postgresql-plpython 0:9.2.24-8.amzn2.0.1
Amazon Linux · 2 postgresql-pltcl 0:9.2.24-8.amzn2.0.1
Amazon Linux · 2 postgresql-server 0:9.2.24-8.amzn2.0.1
Amazon Linux · 2 postgresql-static 0:9.2.24-8.amzn2.0.1
Amazon Linux · 2 postgresql-test 0:9.2.24-8.amzn2.0.1
Amazon Linux · 2 postgresql-upgrade 0:9.2.24-8.amzn2.0.1

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-23214.html