CVE-2022-41862
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certai...
Original description
The description as published by the source.
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.
Affected packages
Bitnami
postgresql
[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"12.14.0"},{"introduced":"13.0.0"},{"fixed":"13.10.0"},{"introduced":"14.0.0"},{"fixed":"14.7.0"},{"introduced":"15.0.0"},{"fixed":"15.2.0"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2022-41862 postgresql Fixed in: 13.11-r0
- Debian DEBIAN-CVE-2022-41862 postgresql-13 Fixed in: 13.10-0+deb11u1
References
- advisory bugzilla.redhat.com
- advisory postgresql.org
- web security.netapp.com
- web nvd.nist.gov