What’s Vulnerable › Vulnerabilities

CVE-2021-43766

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-25 · updated 2026-06-17
• Weakness: CWE-89

Description

Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. This is similar to CVE-2021-23214 for PostgreSQL.

Affected products

• Odyssey: 1.1

References

• https://github.com/yandex/odyssey/issues/376%2C
• https://www.postgresql.org/support/security/CVE-2021-23214/
• https://github.com/yandex/odyssey/issues/376%2C
• https://www.postgresql.org/support/security/CVE-2021-23214/

Get alerted when CVE-2021-43766 or the next vulnerability affects your stack