Skip to content
OpenAdvisories
Low · 3.7 CVE-2022-41862 EUVD-2022-45026GHSA-fr68-cm8v-7vv6

In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption…

Published Mar 3, 2023 · Updated Mar 7, 2025 · Assigned by redhat

Description

In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.

Affected products

VendorProductAffectedFixed
— postgresql postgresql 5.2, postgresql 14.7, postgresql 13.10, postgresql 12.14, postgresql 11.19 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 12 postgresql-15 15.2-1 —
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS postgresql-14 14.7-0ubuntu0.22.04.1 USN-5906-1
Ubuntu 20.04 LTS postgresql-12 12.14-0ubuntu0.20.04.1 USN-5906-1
ReleasePackageFixed inAdvisory
RHEL 9 libpq +1 13.11-1.el9 RHSA-2023:6429
RHEL 9 postgresql +13 13.10-1.el9_1 RHSA-2023:1693
RHEL 8 libpq +1 13.11-1.el8 RHSA-2023:7016
RHEL 8 pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5 RHSA-2023:4535, RHSA-2023:1576
RHEL 8 pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5 RHSA-2023:4535, RHSA-2023:1576
RHEL 8 postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2023:4535, RHSA-2023:1576
RHEL 8 postgresql +12 12.15-1.module+el8.8.0+19427+d1071523 RHSA-2023:4535, RHSA-2023:1576
RHEL 3 rh-postgresql13-postgresql +14 13.13-1.el7 RHSA-2023:7772
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.0 EUS postgresql +10 13.13-1.el9_0 RHSA-2023:7545
RHEL 8.6 EUS pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5 RHSA-2023:7666, RHSA-2023:7580
RHEL 8.6 EUS pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5 RHSA-2023:7666, RHSA-2023:7580
RHEL 8.6 EUS postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2023:7666, RHSA-2023:7580
RHEL 8.6 EUS postgresql +12 12.17-1.module+el8.6.0+20721+c66fb2f5 RHSA-2023:7666, RHSA-2023:7580
RHEL 8.4 TUS pgaudit 1.4.0-6.module+el8.4.0+11288+c193d6d7 RHSA-2023:7695, RHSA-2023:7694
RHEL 8.4 TUS postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2023:7695, RHSA-2023:7694
RHEL 8.4 TUS postgresql +12 12.17-1.module+el8.4.0+20773+7c41d490 RHSA-2023:7695, RHSA-2023:7694
RHEL 8.4 E4S pgaudit 1.4.0-6.module+el8.4.0+11288+c193d6d7 RHSA-2023:7695, RHSA-2023:7694
RHEL 8.4 E4S postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2023:7695, RHSA-2023:7694
RHEL 8.4 E4S postgresql +12 12.17-1.module+el8.4.0+20773+7c41d490 RHSA-2023:7695, RHSA-2023:7694
RHEL 8.4 AUS pgaudit 1.4.0-6.module+el8.4.0+11288+c193d6d7 RHSA-2023:7695, RHSA-2023:7694
RHEL 8.4 AUS postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2023:7695, RHSA-2023:7694
RHEL 8.4 AUS postgresql +12 12.17-1.module+el8.4.0+20773+7c41d490 RHSA-2023:7695, RHSA-2023:7694
RHEL 8.2 TUS pgaudit 1.4.0-4.module+el8.2.0+9043+1dbb5661 RHSA-2023:7667
RHEL 8.2 TUS postgres-decoderbufs 0.10.0-2.module+el8.2.0+9043+1dbb5661 RHSA-2023:7667
RHEL 8.2 TUS postgresql +12 12.17-1.module+el8.2.0+20720+50ffbc0b RHSA-2023:7667
RHEL 8.2 E4S pgaudit 1.4.0-4.module+el8.2.0+9043+1dbb5661 RHSA-2023:7667
RHEL 8.2 E4S postgres-decoderbufs 0.10.0-2.module+el8.2.0+9043+1dbb5661 RHSA-2023:7667
RHEL 8.2 E4S postgresql +12 12.17-1.module+el8.2.0+20720+50ffbc0b RHSA-2023:7667
RHEL 8.2 AUS pgaudit 1.4.0-4.module+el8.2.0+9043+1dbb5661 RHSA-2023:7667
RHEL 8.2 AUS postgres-decoderbufs 0.10.0-2.module+el8.2.0+9043+1dbb5661 RHSA-2023:7667
RHEL 8.2 AUS postgresql +12 12.17-1.module+el8.2.0+20720+50ffbc0b RHSA-2023:7667

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 libpq +1 13.11-1.el9 ALSA-2023:6429
AlmaLinux 9 postgresql +13 13.10-1.el9_1 ALSA-2023:1693
AlmaLinux 8 libpq +1 13.11-1.el8.alma.1 ALSA-2023:7016
AlmaLinux 8 pg_repack 1.4.6-3.module_el8.6.0+2758+4f4474df ALSA-2023:4535, ALSA-2023:1576
AlmaLinux 8 pgaudit 1.4.0-5.module_el8.6.0+2758+4f4474df ALSA-2023:4535, ALSA-2023:1576
AlmaLinux 8 postgres-decoderbufs 0.10.0-2.module_el8.6.0+2758+4f4474df ALSA-2023:4535, ALSA-2023:1576
AlmaLinux 8 postgresql +12 12.15-1.module_el8.8.0+3600+38330172 ALSA-2023:4535, ALSA-2023:1576

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 libpq 13.11-1.el8 RLSA-2023:7016
Rocky Linux 8 pg_repack 1.4.6-3.module+el8.5.0+684+c3892ef9 RLSA-2023:4535, RLSA-2023:1576
Rocky Linux 8 pgaudit 1.4.0-5.module+el8.5.0+686+20453ecc RLSA-2023:4535, RLSA-2023:1576
Rocky Linux 8 postgres-decoderbufs 0.10.0-2.module+el8.5.0+684+c3892ef9 RLSA-2023:4535, RLSA-2023:1576
Rocky Linux 8 postgresql 12.15-1.module+el8.8.0+1441+a10239d2 RLSA-2023:4535, RLSA-2023:1576
ReleasePackageFixed inAdvisory
SLES 15 SP4 postgresql13 13.10-150200.5.37.1 SUSE-SU-2023:0583-1
SLES 15 SP4 postgresql14 14.7-150200.5.23.1 SUSE-SU-2023:0705-1
SLES 15 SP4 postgresql15 15.2-150200.5.6.1 SUSE-SU-2023:0569-1
SLES 15 SP3 postgresql12 12.14-150200.8.41.1 SUSE-SU-2023:0450-1
SLES 15 SP3 postgresql13 13.10-150200.5.37.1 SUSE-SU-2023:0583-1
SLES 15 SP3 postgresql14 14.7-150200.5.23.1 SUSE-SU-2023:0705-1
SLES 15 SP3 postgresql15 15.2-150200.5.6.1 SUSE-SU-2023:0569-1
SLES 15 SP2 postgresql12 12.14-150200.8.41.1 SUSE-SU-2023:0450-1
SLES 15 SP2 postgresql13 13.10-150200.5.37.1 SUSE-SU-2023:0583-1
SLES 15 SP2 postgresql14 14.7-150200.5.23.1 SUSE-SU-2023:0705-1
SLES 15 SP2 postgresql15 15.2-150200.5.6.1 SUSE-SU-2023:0569-1
SLES 15 SP1 postgresql12 12.14-150100.3.37.1 SUSE-SU-2023:0479-1
SLES 12 SP5 postgresql12 12.14-3.36.1 SUSE-SU-2023:0390-1
SLES 12 SP5 postgresql13 13.10-3.30.1 SUSE-SU-2023:0391-1
SLES 12 SP5 postgresql14 14.7-3.20.1 SUSE-SU-2023:0392-1
SLES 12 SP5 postgresql15 15.2-3.6.1 SUSE-SU-2023:0393-1
Show 17 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP4 postgresql15 15.2-3.6.1 SUSE-SU-2023:0393-1
SLES 12 SP2 postgresql15 15.2-3.6.1 SUSE-SU-2023:0393-1
SLES for SAP 15 SP3 postgresql12 12.14-150200.8.41.1 SUSE-SU-2023:0450-1
SLES for SAP 15 SP3 postgresql13 13.10-150200.5.37.1 SUSE-SU-2023:0583-1
SLES for SAP 15 SP3 postgresql14 14.7-150200.5.23.1 SUSE-SU-2023:0705-1
SLES for SAP 15 SP3 postgresql15 15.2-150200.5.6.1 SUSE-SU-2023:0569-1
SLES for SAP 15 SP2 postgresql12 12.14-150200.8.41.1 SUSE-SU-2023:0450-1
SLES for SAP 15 SP2 postgresql13 13.10-150200.5.37.1 SUSE-SU-2023:0583-1
SLES for SAP 15 SP2 postgresql14 14.7-150200.5.23.1 SUSE-SU-2023:0705-1
SLES for SAP 15 SP2 postgresql15 15.2-150200.5.6.1 SUSE-SU-2023:0569-1
SLES for SAP 15 SP1 postgresql12 12.14-150100.3.37.1 SUSE-SU-2023:0479-1
SLES for SAP 12 SP5 postgresql12 12.14-3.36.1 SUSE-SU-2023:0390-1
SLES for SAP 12 SP5 postgresql13 13.10-3.30.1 SUSE-SU-2023:0391-1
SLES for SAP 12 SP5 postgresql14 14.7-3.20.1 SUSE-SU-2023:0392-1
SLES for SAP 12 SP5 postgresql15 15.2-3.6.1 SUSE-SU-2023:0393-1
SLES for SAP 12 SP4 postgresql15 15.2-3.6.1 SUSE-SU-2023:0393-1
SLE Real Time 15 SP3 postgresql13 13.10-150200.5.37.1 SUSE-SU-2023:0583-1
SLE Real Time 15 SP3 postgresql14 14.7-150200.5.23.1 SUSE-SU-2023:0705-1
SLE Real Time 15 SP3 postgresql15 15.2-150200.5.6.1 SUSE-SU-2023:0569-1
SLE HPC 15 SP3 postgresql12 12.14-150200.8.41.1 SUSE-SU-2023:0450-1
SLE HPC 15 SP3 postgresql13 13.10-150200.5.37.1 SUSE-SU-2023:0583-1
SLE HPC 15 SP3 postgresql14 14.7-150200.5.23.1 SUSE-SU-2023:0705-1
SLE HPC 15 SP3 postgresql15 15.2-150200.5.6.1 SUSE-SU-2023:0569-1
SLE HPC 15 SP2 postgresql12 12.14-150200.8.41.1 SUSE-SU-2023:0450-1
SLE HPC 15 SP2 postgresql13 13.10-150200.5.37.1 SUSE-SU-2023:0583-1
SLE HPC 15 SP2 postgresql14 14.7-150200.5.23.1 SUSE-SU-2023:0705-1
SLE HPC 15 SP2 postgresql15 15.2-150200.5.6.1 SUSE-SU-2023:0569-1
SLE HPC 15 SP1 postgresql12 12.14-150100.3.37.1 SUSE-SU-2023:0479-1
SUSE OpenStack Cloud Crowbar 9 postgresql15 15.2-3.6.1 SUSE-SU-2023:0393-1
SUSE OpenStack Cloud 9 postgresql15 15.2-3.6.1 SUSE-SU-2023:0393-1
SUSE Manager Server 4.2 postgresql13 13.10-150200.5.37.1 SUSE-SU-2023:0583-1
SUSE Manager Server 4.2 postgresql14 14.7-150200.5.23.1 SUSE-SU-2023:0705-1
SUSE Manager Server 4.2 postgresql15 15.2-150200.5.6.1 SUSE-SU-2023:0569-1
SUSE Manager Proxy 4.2 postgresql13 13.10-150200.5.37.1 SUSE-SU-2023:0583-1
SUSE Manager Proxy 4.2 postgresql14 14.7-150200.5.23.1 SUSE-SU-2023:0705-1
SUSE Manager Proxy 4.2 postgresql15 15.2-150200.5.6.1 SUSE-SU-2023:0569-1
SUSE Enterprise Storage 7.1 postgresql12 12.14-150200.8.41.1 SUSE-SU-2023:0450-1
SUSE Enterprise Storage 7.1 postgresql13 13.10-150200.5.37.1 SUSE-SU-2023:0583-1
SUSE Enterprise Storage 7.1 postgresql14 14.7-150200.5.23.1 SUSE-SU-2023:0705-1
SUSE Enterprise Storage 7.1 postgresql15 15.2-150200.5.6.1 SUSE-SU-2023:0569-1
SUSE Enterprise Storage 7 postgresql12 12.14-150200.8.41.1 SUSE-SU-2023:0450-1
SUSE Enterprise Storage 7 postgresql13 13.10-150200.5.37.1 SUSE-SU-2023:0583-1
SUSE Enterprise Storage 7 postgresql14 14.7-150200.5.23.1 SUSE-SU-2023:0705-1
SUSE Enterprise Storage 7 postgresql15 15.2-150200.5.6.1 SUSE-SU-2023:0569-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed postgresql12 12.14-1.1 openSUSE-SU-2024:12677-1
openSUSE Tumbleweed postgresql13 13.10-1.1 openSUSE-SU-2024:12678-1
openSUSE Tumbleweed postgresql14 14.7-1.1 openSUSE-SU-2024:12679-1
openSUSE Tumbleweed postgresql15 15.2-1.1 openSUSE-SU-2024:12680-1
openSUSE Tumbleweed postgresql16 16.4-1.1 openSUSE-SU-2024:14360-1
openSUSE Tumbleweed postgresql17 17.6-2.1 openSUSE-SU-2025:15580-1
openSUSE Leap 15.4 postgresql12 12.14-150200.8.41.1 SUSE-SU-2023:0450-1
openSUSE Leap 15.4 postgresql13 13.10-150200.5.37.1 SUSE-SU-2023:0583-1
openSUSE Leap 15.4 postgresql14 14.7-150200.5.23.1 SUSE-SU-2023:0705-1
openSUSE Leap 15.4 postgresql15 15.2-150200.5.6.1 SUSE-SU-2023:0569-1
ReleasePackageFixed inAdvisory
Alpine v3.22 postgresql15 15.2-r0 —
Alpine v3.21 postgresql15 15.2-r0 —
Alpine v3.20 postgresql14 14.7-r0 —
Alpine v3.20 postgresql15 15.2-r0 —
Alpine v3.19 postgresql13 13.10-r0 —
Alpine v3.19 postgresql14 14.7-r0 —
Alpine v3.19 postgresql15 15.2-r0 —
Alpine v3.18 postgresql12 12.14-r0 —
Alpine v3.18 postgresql13 13.10-r0 —
Alpine v3.18 postgresql14 14.7-r0 —
Alpine v3.18 postgresql15 15.2-r0 —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.17 postgresql12 12.14-r0 —
Alpine v3.17 postgresql13 13.10-r0 —
Alpine v3.17 postgresql14 14.7-r0 —
Alpine v3.17 postgresql15 15.2-r0 —
Alpine v3.16 postgresql12 12.15-r0 —
Alpine v3.16 postgresql13 13.10-r0 —
Alpine v3.16 postgresql14 14.7-r0 —
Alpine v3.15 postgresql12 12.15-r0 —
Alpine v3.15 postgresql13 13.10-r0 —
Alpine v3.15 postgresql14 14.7-r0 —
Alpine v3.14 postgresql 13.10-r0 —
Alpine v3.13 postgresql 13.11-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 postgresql15 +15 15.4-1.amzn2023.0.1 ALAS2023-2023-387

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 libpq +1 13.11-1.el9 ELSA-2023-6429
Oracle Linux 9 postgresql +13 13.10-1.el9_1 ELSA-2023-1693
Oracle Linux 8 libpq +1 13.11-1.el8 ELSA-2023-7016
Oracle Linux 8 pg_repack 1.4.6-3.module+el8.5.0+20333+86306fc7 ELSA-2023-4535, ELSA-2023-1576
Oracle Linux 8 pgaudit 1.4.0-5.module+el8.5.0+20333+86306fc7 ELSA-2023-4535, ELSA-2023-1576
Oracle Linux 8 postgres-decoderbufs 0.10.0-2.module+el8.4.0+20016+06fd4df3 ELSA-2023-4535, ELSA-2023-1576
Oracle Linux 8 postgresql +12 12.15-1.0.1.module+el8.8.0+21142+0a9e8b30 ELSA-2023-4535, ELSA-2023-1576

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling postgresql-15 15.2-r0 —

Advisories 46

References