CVE-2022-41862
A modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. When a libpq client application has a Kerberos credential cache and doesn't explicitly disable option gssencmode , a server can cause libpq to over-read and report an error message containing uninitialized bytes from and following its receive buffer. If libpq's caller somehow makes that message accessible to the attacker, this achieves a disclosure of the over-read bytes. We have not confirmed or ruled out viability of attacks that arrange for a crash or for presence of notable, confidential information in disclosed bytes. The PostgreSQL project thanks Jacob Champion for reporting this problem.
Version Information
| Affected branch | Introduced | Fixed In | Fix Published |
|---|---|---|---|
| 12 | — | 12.14 | 2023-02-09 |
| 13 | — | 13.10 | 2023-02-09 |
| 14 | — | 14.7 | 2023-02-09 |
| 15 | — | 15.2 | 2023-02-09 |
CVSS 3.0
| Overall Score | 3.7 |
|---|---|
| Component | client |
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
First published: 2023-02-09
Historical source observations
These dated records preserve the original source claims separately from the reviewed fix list.
center · 2026-10-03 12:08:35.169032+08
- PostgreSQL 15 · Original minor coordinate: 2
- PostgreSQL 14 · Original minor coordinate: 7
pgweb · 2026-10-03 12:08:55.967155+08
- PostgreSQL 15 · Original minor coordinate: 2
- PostgreSQL 14 · Original minor coordinate: 7