CVE-2021-23214: Fedoraproject Fedora

High severity, CVSS 8.1. EPSS: 1.9% chance of exploitation in the next 30 days.

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

Affected products

• Fedoraproject Fedora: version 34 only; version 35 only
• PostgreSQL PostgreSQL: before 9.6.24 (fixed in 9.6.24); from 10.0, before 10.19 (fixed in 10.19); from 11.0, before 11.14 (fixed in 11.14); from 12.0, before 12.9 (fixed in 12.9); from 13.0, before 13.5 (fixed in 13.5); version 14.0 only
• Red Hat Enterprise Linux: version 8.0 only
• Red Hat Enterprise Linux For IBM Z Systems: version 8.0 only
• Red Hat Enterprise Linux For Power Little Endian: version 8.0 only
• Red Hat Software Collections: version 1.0 only

Published 2022-03-04. Last modified 2026-06-17.