description: When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.
problem types: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
affected:
{
vendor: n/a
product: postgresql
versions:
version: Affects v9.6 to v14, status: affected
}