CVE-2021-3935

Katalog CVE

CVSS 8.1 · High EPSS 1,1%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada pgbouncer, redhat enterprise linux +2 lainnya. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1.

Rincian

Terbit di NVD

22 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-295: Improper Certificate Validation

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.pgbouncer.org/changelog.html#pgbouncer-116x release notes · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2021251 issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/02/msg00016.html mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNPCV3KRDI5PL...
• https://lists.debian.org/debian-lts-announce/2025/05/msg00032.html