CVE-2022-41862
Low
Description
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.
SeverityLow
CVSS3.7
Exploit probability—
Product
Postgresql
PublishedMar 3, 2023
First seenMar 3, 2023
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- postgresql postgresql12.14, 13.10, 14.7, 15.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| postgresql postgresql | 12.0 ≤ v < 12.14, 13.0 ≤ v < 13.10, 14.0 ≤ v < 14.7, 15.0 ≤ v < 15.2 | 12.14, 13.10, 14.7, 15.2 |
| fedoraproject fedora | 8 | — |
| redhat integration_camel_k | No range specified | — |
| redhat integration_camel_quarkus | No range specified | — |
| redhat integration_service_registry | No range specified | — |
| redhat enterprise_linux | 8.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.