Summary
Jacob Champion discovered that the PostgreSQL client incorrectly handled
Kerberos authentication. If a user or automated system were tricked into
connecting to a malicious server, a remote attacker could possibly use this
issue to obtain sensitive information.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | postgresql-12 | 12.14-0ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | postgresql-14 | 14.7-0ubuntu0.22.04.1 |
Vulnerabilities 1
-
Low 3.7
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos …
References
-
report
https://ubuntu.com/security/CVE-2022-41862