{
"id": "GHSA-72rj-36qc-47g7",
"aliases": [
"CVE-2021-31671"
],
"details": "pgsync before 0.6.7 is affected by Information Disclosure of sensitive information. Syncing the schema with the `--schema-first` and `--schema-only` options is mishandled. For example, the sslmode connection parameter may be lost, which means that SSL would not be used.",
"summary": "Pgsync Contains Cleartext Transmission of Sensitive Information",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.7"
}
]
}
],
"package": {
"name": "pgsync",
"ecosystem": "RubyGems"
}
}
],
"modified": "2023-08-25T22:09:00Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"published": "2021-04-27T15:54:52Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31671",
"type": "ADVISORY"
},
{
"url": "https://github.com/ankane/pgsync/issues/121",
"type": "WEB"
},
{
"url": "https://github.com/ankane/pgsync/commit/05cd18f5fc09407e4b544f2c12f819cabc50c40e",
"type": "WEB"
},
{
"url": "https://github.com/ankane/pgsync/blob/master/CHANGELOG.md#067-2021-04-26",
"type": "WEB"
},
{
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pgsync/CVE-2021-31671.yml",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-319"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2021-04-27T03:15:00Z",
"github_reviewed_at": "2021-04-27T15:54:16Z"
}
}