DemoBook a demo

Vulnerability advisory

CVE-2023-31136

PostgresNIO processes unencrypted bytes from man-in-the-middle

Published Updated OSV record ↗

Also known as GHSA-9cfh-vx93-84vv

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/apple/swift-nio ↗
All commits before 8da5c5a4e6c5084c296b9f39dc54f00be146e0fa8da5c5a4e6c5084c296b9f39dc54f00be146e0fa
GIT github.com/vapor/postgres-nio ↗
All commits before 2df54bc94607f44584ae6ffa74e3cd754fffafc72df54bc94607f44584ae6ffa74e3cd754fffafc7
Also listed as affected (60)
  • 1.14.1
  • 1.14.0
  • 1.13.2
  • 1.13.1
  • 1.13.0
  • 1.12.1
  • 1.12.0
  • 1.11.0
  • 1.10.0
  • 1.9.0
  • 1.6.1
  • 1.7.2
  • 1.4.2
  • 1.5.1
  • 1.2.1
  • 1.3.1
  • 1.0.0
  • 1.1.0
  • 1.8.0
  • 1.7.1
  • 1.7.0
  • 1.6.0
  • 1.5.0
  • 1.4.1
  • 1.4.0
  • 1.3.0
  • 1.2.0
  • 1.11.1
  • 1.6.5
  • 1.6.4
  • 1.6.3
  • 1.6.2
  • 1.5.2
  • 1.4.4
  • 1.4.3
  • 1.2.2
  • 1.1.1
  • 1.0.1
  • 1.0.0-rc.2
  • 1.0.0-rc.1.2
  • 1.0.0-rc.1.1
  • 1.0.0-rc.1
  • 1.0.0-beta.2.10
  • 1.0.0-beta.2.9
  • 1.0.0-beta.2.8
  • 1.0.0-beta.2.7
  • 1.0.0-beta.2.6
  • 1.0.0-beta.2.5
  • 1.0.0-beta.2.4
  • 1.0.0-beta.2.3
  • 1.0.0-beta.2.2
  • 1.0.0-beta.2.1
  • 1.0.0-beta.2
  • 1.0.0-alpha.1.6
  • 1.0.0-alpha.1.5
  • 1.0.0-alpha.1.4
  • 1.0.0-alpha.1.3
  • 1.0.0-alpha.1.2
  • 1.0.0-alpha.1.1
  • 1.0.0-alpha.1

Description

PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.