CVE-2021-3935

Summary:

When PgBouncer is configured to use “cert” authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1.

Reference Links(if available):

https://bugzilla.redhat.com/show_bug.cgi?id=2021251

http://www.pgbouncer.org/changelog.html#pgbouncer-116x

CVSS Score (if available)

v2: / MEDIUM

v3: /

Links to Exploits(if available)