CVE-2022-41862: Infoleak
A modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. When a libpq client application has a Kerberos credential cache and doesn't explicitly disable option "gssencmode", a server can cause libpq to over-read and report an error message containing uninitialized bytes from and following its receive buffer. If libpq's caller somehow makes that message accessible to the attacker, this achieves a disclosure of the over-read bytes. We have not confirmed or ruled out viability of attacks that arrange for a crash or for presence of notable, confidential information in disclosed bytes.
Other sources
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.
— MITRE
PostgreSQL could allow a remote attacker to obtain sensitive information, caused by a client memory disclosure flaw. By sending an unterminated string during the establishment of Kerberos transport encryption, an attacker could exploit this vulnerability to obtain sensitive information.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 5.2 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 14.7 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 13.10 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 12.14 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 11.19
Event History
Frequently Asked Questions
What is CVE-2022-41862?
CVE-2022-41862 is a vulnerability in PostgreSQL that allows a modified, unauthenticated server to send an unterminated string during the establishment of Kerberos transport encryption.
How does CVE-2022-41862 affect PostgreSQL?
CVE-2022-41862 affects certain versions of PostgreSQL (up to and excluding version 15.2) where a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.
What is the severity of CVE-2022-41862?
CVE-2022-41862 has a low severity rating with a score of 3.7.
Which software versions are affected by CVE-2022-41862?
PostgreSQL versions 5.2 up to and excluding 15.2, 8.0 Fedora, Redhat Integration Camel K, Redhat Integration Camel Quarkus, Redhat Integration Service Registry, and Redhat Enterprise Linux 8.0 are affected by CVE-2022-41862.
How can I fix CVE-2022-41862?
To fix CVE-2022-41862, users should update their PostgreSQL installations to versions 15.2, 14.7, 13.10, 12.14, or 11.19 depending on the affected version.