NetSight
IP …
high8.1

CVE-2021-3935

When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established…

Impact

When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1.

Affected products

VendorProductAffected versions
PgbouncerPgbouncer
before 1.16.1
RedhatEnterprise Linux
Version 7.0
FedoraprojectFedora
Version 35
DebianDebian Linux
Version 9.0

Weakness classification

CWE-89CWE-295

References