Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-10977

Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

Published

2024-11-14T13:15:04.023

Last Modified

2025-02-20T15:38:01.697

Status

Analyzed

Source

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Severity

CVSSv3.1: 3.1 (LOW)

Weaknesses
  • Type: Secondary
    CWE-348
  • Type: Primary
    CWE-345
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application postgresql postgresql < 12.21 Yes
Application postgresql postgresql < 13.17 Yes
Application postgresql postgresql < 14.14 Yes
Application postgresql postgresql < 15.9 Yes
Application postgresql postgresql < 16.5 Yes
Application postgresql postgresql 17.0 Yes
Application postgresql postgresql 17.0 Yes
Application postgresql postgresql 17.0 Yes
Application postgresql postgresql 17.0 Yes
Application postgresql postgresql 17.0 Yes
References