Jacob Champion

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions prior to 17.1 PostgreSQL versions prior to 16.5 PostgreSQL versions prior to 15.9 PostgreSQL versions prior to 14.14 PostgreSQL versions prior to 13.17 PostgreSQL versions prior to 12.21 Description: The issue is related to the client use of server error messages in PostgreSQL, allowing a non-trusted server to provide arbitrary non-NUL bytes to the libpq application under current SSL or GSS settings. This could enable a man-in-the-middle attacker to send a long error message that could be mistaken for valid query results by a human or screen-scraper user of psql. However, this is likely not a concern for clients where the user interface clearly indicates the boundary between one error message and other text. Recommendations: For versions prior to 17.1, update to PostgreSQL 17.1 or later. For versions prior to 16.5, update to PostgreSQL 16.5 or later. For versions prior to 15.9, update to PostgreSQL 15.9 or later. For versions prior to 14.14, update to PostgreSQL 14.14 or later. For versions prior to 13.17, update to PostgreSQL 13.17 or later. For versions prior to 12.21, update to PostgreSQL 12.21 or later.

The issue is related to the handling of GSS message tokens in the Kerberos authentication protocol. An attacker can cause invalid memory reads by sending message tokens with invalid length fields, potentially impacting the confidentiality, integrity, and availability of protected information. This can be exploited by a remote attacker.

The issue is related to the modification of the plaintext Extra Count field of a confidential GSS krb5 wrap token. This can cause the unwrapped token to appear truncated to the application, potentially allowing a remote attacker to gain unauthorized access to the GSS krb5 token.

The issue is related to information disclosure in PostgreSQL. It occurs when a modified, unauthenticated server sends an unterminated string during the establishment of Kerberos transport encryption, potentially causing a libpq client to over-read and report an error message containing uninitialized bytes. This could allow a remote attacker to gain unauthorized access to protected information.

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption. The vulnerability in the libpq library of the PostgreSQL database management system is related to insufficient protection of registration data, which can allow a remote attacker to implement a man-in-the-middle attack.

The issue is related to a man-in-the-middle attack when the server is configured to use trust authentication with a clientcert requirement or to use cert authentication. This allows an attacker to inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. The vulnerability is associated with the lack of protection for the SQL query structure, which can enable a remote attacker to execute arbitrary code.