p PatchFirst

CVE-2022-41862

CVE-2022-41862

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.

CVSS 3.7 · Low · EPSS 0.6% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • postgresql

    Versions
    • postgresql 5.2, postgresql 14.7, postgresql 13.10, postgresql 12.14, postgresql 11.19: Affected

    No fix published

  • postgresql-15 Debian:12

    Affected ranges
    • ECOSYSTEM: < 15.2-1

    Update to 15.2-1

  • postgresql-12 Ubuntu:20.04:LTS

    Versions
    • 12.0-1
    • 12.1-1
    • 12.1-2build1
    • 12.2-1
    • 12.2-1ubuntu2
    • 12.2-4
    • 12.4-0ubuntu0.20.04.1
    • 12.5-0ubuntu0.20.04.1
    • 12.6-0ubuntu0.20.04.1
    • 12.7-0ubuntu0.20.04.1
    • 12.8-0ubuntu0.20.04.1
    • 12.9-0ubuntu0.20.04.1
    • 12.10-0ubuntu0.20.04.1
    • 12.11-0ubuntu0.20.04.1
    • 12.12-0ubuntu0.20.04.1
    • 12.13-0ubuntu0.20.04.1
    Affected ranges
    • ECOSYSTEM: < 12.14-0ubuntu0.20.04.1

    Update to 12.14-0ubuntu0.20.04.1

  • postgresql-14 Ubuntu:22.04:LTS

    Versions
    • 14.1-1ubuntu1
    • 14.2-1
    • 14.2-1ubuntu1
    • 14.3-0ubuntu0.22.04.1
    • 14.4-0ubuntu0.22.04.1
    • 14.5-0ubuntu0.22.04.1
    • 14.6-0ubuntu0.22.04.1
    Affected ranges
    • ECOSYSTEM: < 14.7-0ubuntu0.22.04.1

    Update to 14.7-0ubuntu0.22.04.1

Original sources

Check your server →