CVE-2023-31136

Katalog CVE

CVSS 5.9 · Medium EPSS 0,49%

Kerentanan Insufficiently Protected Credentials pada vapor postgresnio. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users.

Rincian

Terbit di NVD

9 Mei 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv advisory vendor
• https://github.com/apple/swift-nio/pull/2419 patch
• https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7 patch
• https://github.com/advisories/GHSA-467w-rrqc-395f not applicable
• https://github.com/advisories/GHSA-735f-7qx4-jqq5 not applicable
• https://github.com/vapor/postgres-nio/releases/tag/1.14.2 release notes
• https://www.postgresql.org/support/security/CVE-2021-23214/ not applicable
• https://www.postgresql.org/support/security/CVE-2021-23222/ not applicable