SQL Injection Vulnerability in PostgreSQL with Trust Authentication

CVE-2021-23214

Summary

A vulnerability exists in the PostgreSQL database when configured with trust authentication alongside a client certificate requirement. This can allow a man-in-the-middle attacker to craft and inject arbitrary SQL queries during the initial connection setup. This occurs even with SSL certificate verification and encryption enabled, exposing users to significant risk if they do not secure their database instances properly.

References