CVE-2023-31136lowCWE-522

CVE-2023-31136: low-severity vulnerability in vapor postgres-nio

PostgresNIO processes unencrypted bytes from man-in-the-middle

Published · Updated

Follow this CVE+ Monitor postgres-nio

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.7epss 0.5%
In short

PostgresNIO, a Swift PostgreSQL client, fails to properly verify TLS connections before processing server responses, allowing attackers on the network to intercept and inject fake data into the first queries sent by the client. This undermines the protection that TLS encryption is supposed to provide.

Technical detail

The vulnerability exists in PostgresNIO versions before 1.14.2 where the client processes unencrypted or unverified bytes from the server before completing TLS handshake validation. An attacker positioned as a man-in-the-middle can inject malicious responses to early queries, exploiting insufficient verification of the TLS session initialization. The attack requires network proximity but bypasses certificate verification mechanisms.

Summary generated and translated by AI from the official description.
PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
vapor · postgres-nio