Test Kennung:	1.3.6.1.4.1.25623.1.0.127334
Kategorie:	Databases
Titel:	PostgreSQL 12.x < 12.14, 13.x < 13.10, 14.x < 14.7, 15.x < 15.2 Information Disclosure Vulnerability - Linux
Zusammenfassung:	PostgreSQL is prone to an information disclosure; vulnerability.
Beschreibung:	Summary: PostgreSQL is prone to an information disclosure vulnerability. Vulnerability Insight: A modified, unauthenticated server or an unauthenticated man-in-the-middle can send an unterminated string during the establishment of Kerberos transport encryption. When a libpq client application has a Kerberos credential cache and doesn't explicitly disable option gssencmode, a server can cause libpq to over-read and report an error message containing uninitialized bytes from and following its receive buffer. If libpq's caller somehow makes that message accessible to the attacker, this achieves a disclosure of the over-read bytes. Affected Software/OS: PostgreSQL versions 12.x prior to 12.14, 13.x prior to 13.10, 14.x prior to 14.7 and 15.x prior to 15.2. Solution: Update to version 12.14, 13.10, 14.7, 15.2 or later. CVSS Score: 2.6 CVSS Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2022-41862 https://bugzilla.redhat.com/show_bug.cgi?id=2165722 https://www.postgresql.org/support/security/CVE-2022-41862/
Copyright	Copyright (C) 2023 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.