Low: libpq security update
Summary
ALSA-2022:1891: Low: libpq security update. Affects libpq versions < 13.5-1.el8. Fixed in 13.5-1.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libpq package is the PostgreSQL client library, enabling client programs to connect to PostgreSQL servers. It provides essential functionality for establishing and managing connections, executing queries, and handling result sets. The package is widely used in various applications and frameworks that interact with PostgreSQL databases.
Vulnerability Detail
The libpq package is affected by a security vulnerability identified as CVE-2021-23222. This vulnerability allows an attacker positioned as a man-in-the-middle to intercept and process unencrypted bytes. By exploiting this vulnerability, an attacker can potentially gain unauthorized access to sensitive information transmitted between the client and the PostgreSQL server. The impact of this vulnerability can vary depending on the nature of the data being transmitted and the security measures in place.
How To Fix
Minimum fixed version
13.5-1.el8
This is the first release that contains the fix.
sudo dnf update libpqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Applying the security update is the recommended solution.
Conclusion
The libpq package used for connecting client programs to PostgreSQL servers is affected by a security vulnerability (CVE-2021-23222). To mitigate the risk, it is crucial to update the libpq package to version 13.5-1.el8 or later. This update includes the necessary security patches to address the vulnerability. Failure to apply the update may expose sensitive information transmitted between the client and the PostgreSQL server to potential unauthorized access. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libpq →
FAQ
The libpq package is the PostgreSQL client library, facilitating connections between client programs and PostgreSQL servers.
This vulnerability allows an attacker positioned as a man-in-the-middle to intercept and process unencrypted bytes, potentially leading to unauthorized access to sensitive information transmitted between the client and the PostgreSQL server.
To fix this vulnerability, update the libpq package to version 13.5-1.el8 or later.
No, there is no known workaround for this vulnerability. Applying the security update is the recommended solution.
You can find more information about this vulnerability in the CVE page associated with CVE-2021-23222.
References
Related vulnerabilities
Recent vulnerabilities recorded for libpq.
