CVE-2023-31136 PostgresNIO processes unencrypted bytes from man-in-the-middle
A man-in-the-middle attacker can inject false responses to initial queries in PostgresNIO despite TLS encryption, compromising data integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-31136?
CVE-2023-31136 is a low-severity vulnerability in vapor postgres-nio, published on 9 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users.
Weakness: CWE-522
Which versions are affected by CVE-2023-31136?
2 open source packages ship an affected version, including github.com/vapor/postgres-nio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/vapor/postgres-nio SwiftURL | All versions | 1.14.2 |
github.com/vapor/postgres-nio SwiftURL | All versions | 1.14.2 |
Products include Vapor Postgresnio.
How do I fix CVE-2023-31136?
Upgrade github.com/vapor/postgres-nio to 1.14.2 or later.
Is CVE-2023-31136 being exploited?
There is no known exploitation of CVE-2023-31136 in the wild and no public exploit code.
Sources
Also known as GHSA-9cfh-vx93-84vv.