Test ID:	1.3.6.1.4.1.25623.1.1.2.2023.1346
Category:	Huawei EulerOS Local Security Checks
Title:	Huawei EulerOS: Security Advisory for postgresql-10.5 (EulerOS-SA-2023-1346)
Summary:	The remote host is missing an update for the Huawei EulerOS 'postgresql-10.5' package(s) announced via the EulerOS-SA-2023-1346 advisory.
Description:	Summary: The remote host is missing an update for the Huawei EulerOS 'postgresql-10.5' package(s) announced via the EulerOS-SA-2023-1346 advisory. Vulnerability Insight: Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. This is similar to CVE-2021-23214 for PostgreSQL.(CVE-2021-43766) Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's first few queries. Despite the use of SSL certificate verification and encryption, Odyssey will pass these results to client as if they originated from valid server. This is similar to CVE-2021-23222 for PostgreSQL.(CVE-2021-43767) Affected Software/OS: 'postgresql-10.5' package(s) on Huawei EulerOS V2.0SP8. Solution: Please install the updated package(s). CVSS Score: 7.6 CVSS Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-43766 https://github.com/yandex/odyssey/issues/376, https://www.postgresql.org/support/security/CVE-2021-23214/ Common Vulnerability Exposure (CVE) ID: CVE-2021-43767 https://github.com/yandex/odyssey/issues/377, https://www.postgresql.org/support/security/CVE-2021-23222/
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.