ID de Prueba:	1.3.6.1.4.1.25623.1.0.127333
Categoría:	Databases
Título:	PostgreSQL 12.x < 12.14, 13.x < 13.10, 14.x < 14.7, 15.x < 15.2 Information Disclosure Vulnerability - Windows
Resumen:	PostgreSQL is prone to an information disclosure; vulnerability.
Descripción:	Summary: PostgreSQL is prone to an information disclosure vulnerability. Vulnerability Insight: A modified, unauthenticated server or an unauthenticated man-in-the-middle can send an unterminated string during the establishment of Kerberos transport encryption. When a libpq client application has a Kerberos credential cache and doesn't explicitly disable option gssencmode, a server can cause libpq to over-read and report an error message containing uninitialized bytes from and following its receive buffer. If libpq's caller somehow makes that message accessible to the attacker, this achieves a disclosure of the over-read bytes. Affected Software/OS: PostgreSQL versions 12.x prior to 12.14, 13.x prior to 13.10, 14.x prior to 14.7 and 15.x prior to 15.2. Solution: Update to version 12.14, 13.10, 14.7, 15.2 or later. CVSS Score: 2.6 CVSS Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2022-41862 https://bugzilla.redhat.com/show_bug.cgi?id=2165722 https://www.postgresql.org/support/security/CVE-2022-41862/
Copyright	Copyright (C) 2023 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.