pgpool-II 4.3RC1 Documentation | |||
---|---|---|---|
Prev | Up | Appendix A. Release Notes | Next |
Release Date: 2021-11-18
In this release same bug fixes as Pgpool-II 4.2.6 are already applied. See Section A.4 for more details of those fixes. Note that following vulnability fix is also applied.
Reject extraneous data after SSL encryption handshake. (Tatsuo Ishii)
In the server side implementation of SSL negotiation, it was possible for a man-in-the-middle attacker to inject arbitrary SQL commands. This is possible if Pgpool-II is configured to use cert authentication or hostssl + trust. This resembles PostgreSQL's CVE-2021-23214.
Similarly, in the client side implementation of SSL negotiation, it was possible for a man-in-the-middle attacker to inject arbitrary responses. This is possible if PostgreSQL is using trust authentication with a clientcert requirement. It is not possible with cert authentication because Pgpool-II does not implement the cert authentication between Pgpool-II and PostgreSQL. This resembles PostgreSQL's CVE-2021-23222.