Test ID:	1.3.6.1.4.1.25623.1.0.127334
Category:	Databases
Title:	PostgreSQL 12.x < 12.14, 13.x < 13.10, 14.x < 14.7, 15.x < 15.2 Information Disclosure Vulnerability - Linux
Summary:	PostgreSQL is prone to an information disclosure; vulnerability.
Description:	Summary: PostgreSQL is prone to an information disclosure vulnerability. Vulnerability Insight: A modified, unauthenticated server or an unauthenticated man-in-the-middle can send an unterminated string during the establishment of Kerberos transport encryption. When a libpq client application has a Kerberos credential cache and doesn't explicitly disable option gssencmode, a server can cause libpq to over-read and report an error message containing uninitialized bytes from and following its receive buffer. If libpq's caller somehow makes that message accessible to the attacker, this achieves a disclosure of the over-read bytes. Affected Software/OS: PostgreSQL versions 12.x prior to 12.14, 13.x prior to 13.10, 14.x prior to 14.7 and 15.x prior to 15.2. Solution: Update to version 12.14, 13.10, 14.7, 15.2 or later. CVSS Score: 2.6 CVSS Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2022-41862 https://bugzilla.redhat.com/show_bug.cgi?id=2165722 https://www.postgresql.org/support/security/CVE-2022-41862/
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.