Jacob Champion

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions prior to 17.1 PostgreSQL versions prior to 16.5 PostgreSQL versions prior to 15.9 PostgreSQL versions prior to 14.14 PostgreSQL versions prior to 13.17 PostgreSQL versions prior to 12.21 Description: The issue is related to the client use of server error messages in PostgreSQL, allowing a non-trusted server to provide arbitrary non-NUL bytes to the libpq application under current SSL or GSS settings. This could enable a man-in-the-middle attacker to send a long error message that could be mistaken for valid query results by a human or screen-scraper user of psql. However, this is likely not a concern for clients where the user interface clearly indicates the boundary between one error message and other text. Recommendations: For versions prior to 17.1, update to PostgreSQL 17.1 or later. For versions prior to 16.5, update to PostgreSQL 16.5 or later. For versions prior to 15.9, update to PostgreSQL 15.9 or later. For versions prior to 14.14, update to PostgreSQL 14.14 or later. For versions prior to 13.17, update to PostgreSQL 13.17 or later. For versions prior to 12.21, update to PostgreSQL 12.21 or later.

**Name of the Vulnerable Software and Affected Versions** MIT Kerberos 5 versions prior to 1.21.3 **Description** The issue is related to the handling of GSS message tokens in the Kerberos authentication protocol. An attacker can cause invalid memory reads by sending message tokens with invalid length fields, potentially impacting the confidentiality, integrity, and availability of protected information. This can be exploited by a remote attacker. **Recommendations** For versions prior to 1.21.3, update to version 1.21.3 or later to resolve the issue. As a temporary workaround, consider restricting access to GSS message token handling until a patch is available.

**Name of the Vulnerable Software and Affected Versions** MIT Kerberos 5 versions prior to 1.21.3 **Description** The issue is related to the modification of the plaintext Extra Count field of a confidential GSS krb5 wrap token. This can cause the unwrapped token to appear truncated to the application, potentially allowing a remote attacker to gain unauthorized access to the GSS krb5 token. **Recommendations** For versions prior to 1.21.3, update to version 1.21.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the GSS krb5 wrap token to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL (affected versions not specified) **Description** The issue is related to information disclosure in PostgreSQL. It occurs when a modified, unauthenticated server sends an unterminated string during the establishment of Kerberos transport encryption, potentially causing a libpq client to over-read and report an error message containing uninitialized bytes. This could allow a remote attacker to gain unauthorized access to protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL libpq (affected versions not specified) **Description** A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption. The vulnerability in the libpq library of the PostgreSQL database management system is related to insufficient protection of registration data, which can allow a remote attacker to implement a man-in-the-middle attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions prior to the fixed version **Description** The issue is related to a man-in-the-middle attack when the server is configured to use trust authentication with a clientcert requirement or to use cert authentication. This allows an attacker to inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. The vulnerability is associated with the lack of protection for the SQL query structure, which can enable a remote attacker to execute arbitrary code. **Recommendations** For versions prior to the fixed version, consider disabling the use of trust authentication with a clientcert requirement or cert authentication until a patch is available. Restrict access to the SQL query structure to minimize the risk of exploitation. Avoid using unencrypted connections to prevent man-in-the-middle attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.