Vulnerability · Published Mar 3, 2023 · Assigned by redhat
CVE-2022-41862
Low 3.7
In plain English
A low-severity information exposure in postgresql. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.6%top 50.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libpq | 13.11-1.el8.alma.1 | ALSA-2023:7016 |
| AlmaLinux:9 | libpq | 13.11-1.el9 | ALSA-2023:6429 |
| AlmaLinux:8 | libpq-devel | 13.11-1.el8.alma.1 | ALSA-2023:7016 |
| AlmaLinux:9 | libpq-devel | 13.11-1.el9 | ALSA-2023:6429 |
| AlmaLinux:8 | pg_repack | 1.4.6-3.module_el8.6.0+2758+4f4474df | ALSA-2023:4535 |
| AlmaLinux:8 | pg_repack | 1.4.6-3.module_el8.6.0+2760+1746ec94 | ALSA-2023:1576 |
| AlmaLinux:8 | pg_repack | 1.4.6-3.module_el8.6.0+3094+eb237fb8 | ALSA-2023:4535 |
| AlmaLinux:8 | pg_repack | 1.4.6-3.module_el8.6.0+3095+ee60d910 | ALSA-2023:1576 |
| AlmaLinux:8 | pgaudit | 1.4.0-5.module_el8.6.0+3094+eb237fb8 | ALSA-2023:4535 |
| AlmaLinux:8 | pgaudit | 1.5.0-1.module_el8.6.0+2760+1746ec94 | ALSA-2023:1576 |
| AlmaLinux:8 | pgaudit | 1.5.0-1.module_el8.6.0+3095+ee60d910 | ALSA-2023:1576 |
| AlmaLinux:8 | pgaudit | 1.4.0-5.module_el8.6.0+2758+4f4474df | ALSA-2023:4535 |
| AlmaLinux:8 | postgres-decoderbufs | 0.10.0-2.module_el8.6.0+2758+4f4474df | ALSA-2023:4535 |
| AlmaLinux:8 | postgres-decoderbufs | 0.10.0-2.module_el8.6.0+3094+eb237fb8 | ALSA-2023:4535 |
| AlmaLinux:8 | postgres-decoderbufs | 0.10.0-2.module_el8.6.0+3095+ee60d910 | ALSA-2023:1576 |
| AlmaLinux:8 | postgres-decoderbufs | 0.10.0-2.module_el8.6.0+2760+1746ec94 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:9 | postgresql | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-contrib | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:8 | postgresql-contrib | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:9 | postgresql-contrib | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-docs | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql-docs | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:9 | postgresql-docs | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-plperl | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql-plperl | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:9 | postgresql-plperl | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-plpython3 | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql-plpython3 | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:9 | postgresql-plpython3 | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-pltcl | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql-pltcl | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:9 | postgresql-pltcl | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:9 | postgresql-private-devel | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:9 | postgresql-private-libs | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-server | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:8 | postgresql-server | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:9 | postgresql-server | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-server-devel | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql-server-devel | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:9 | postgresql-server-devel | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-static | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql-static | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:9 | postgresql-static | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-test | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:8 | postgresql-test | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:9 | postgresql-test | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-test-rpm-macros | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:8 | postgresql-test-rpm-macros | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql-upgrade | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql-upgrade | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:9 | postgresql-upgrade | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-upgrade-devel | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:8 | postgresql-upgrade-devel | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:9 | postgresql-upgrade-devel | 13.10-1.el9_1 | ALSA-2023:1693 |
| Alpine:v3.20 | postgresql14 | 14.7-r0 | ALPINE-CVE-2022-41862 |
| Alpine:v3.20 | postgresql15 | 15.2-r0 | ALPINE-CVE-2022-41862 |
| Alpine:v3.21 | postgresql15 | 15.2-r0 | ALPINE-CVE-2022-41862 |
| Alpine:v3.22 | postgresql15 | 15.2-r0 | ALPINE-CVE-2022-41862 |
| Debian:12 | postgresql-15 | 15.2-1 | DEBIAN-CVE-2022-41862 |
| Rocky Linux:8 | libpq | 0:13.11-1.el8 | RLSA-2023:7016 |
| Rocky Linux:8 | pg_repack | 0:1.4.6-3.module+el8.5.0+684+c3892ef9 | RLSA-2023:4535 |
| Rocky Linux:8 | pg_repack | 0:1.4.6-3.module+el8.5.0+684+c3892ef9 | RLSA-2023:1576 |
| Rocky Linux:8 | pgaudit | 0:1.5.0-1.module+el8.5.0+684+c3892ef9 | RLSA-2023:1576 |
| Rocky Linux:8 | pgaudit | 0:1.4.0-5.module+el8.5.0+686+20453ecc | RLSA-2023:4535 |
| Rocky Linux:8 | postgres-decoderbufs | 0:0.10.0-2.module+el8.5.0+684+c3892ef9 | RLSA-2023:4535 |
| Rocky Linux:8 | postgres-decoderbufs | 0:0.10.0-2.module+el8.5.0+684+c3892ef9 | RLSA-2023:1576 |
| Rocky Linux:8 | postgresql | 0:12.15-1.module+el8.8.0+1441+a10239d2 | RLSA-2023:4535 |
| Rocky Linux:8 | postgresql | 0:13.10-1.module+el8.7.0+1175+026203e7 | RLSA-2023:1576 |
| Ubuntu:22.04:LTS | postgresql-14 | 14.7-0ubuntu0.22.04.1 | USN-5906-1 |
| Ubuntu:22.04:LTS | postgresql-14 | 14.7-0ubuntu0.22.04.1 | UBUNTU-CVE-2022-41862 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | postgresql | postgresql 5.2, postgresql 14.7, postgresql 13.10, postgresql 12.14, postgresql 11.19 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N