Vulnerability · Published Nov 14, 2024 · Assigned by PostgreSQL
CVE-2024-10977PostgreSQL libpq retains an error message from man-in-the-middle
Low 3.1
In plain English
A low-severity security flaw in PostgreSQL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | postgresql14 | 14.14-r0 | ALPINE-CVE-2024-10977 |
| Alpine:v3.20 | postgresql15 | 15.9-r0 | ALPINE-CVE-2024-10977 |
| Alpine:v3.21 | postgresql15 | 15.9-r0 | ALPINE-CVE-2024-10977 |
| Alpine:v3.22 | postgresql15 | 15.9-r0 | ALPINE-CVE-2024-10977 |
| Alpine:v3.20 | postgresql16 | 16.5-r0 | ALPINE-CVE-2024-10977 |
| Alpine:v3.21 | postgresql16 | 16.5-r0 | ALPINE-CVE-2024-10977 |
| Alpine:v3.22 | postgresql16 | 16.5-r0 | ALPINE-CVE-2024-10977 |
| Alpine:v3.23 | postgresql16 | 16.5-r0 | ALPINE-CVE-2024-10977 |
| Alpine:v3.24 | postgresql16 | 16.5-r0 | ALPINE-CVE-2024-10977 |
| Alpine:v3.21 | postgresql17 | 17.1-r0 | ALPINE-CVE-2024-10977 |
| Alpine:v3.22 | postgresql17 | 17.1-r0 | ALPINE-CVE-2024-10977 |
| Alpine:v3.23 | postgresql17 | 17.1-r0 | ALPINE-CVE-2024-10977 |
| Alpine:v3.24 | postgresql17 | 17.1-r0 | ALPINE-CVE-2024-10977 |
| Debian:12 | postgresql-15 | 15.9-0+deb12u1 | DEBIAN-CVE-2024-10977 |
| Debian:12 | postgresql-15 | 15.9-0+deb12u1 | DSA-5812-1 |
| Debian:13 | postgresql-17 | 17.1-1 | DEBIAN-CVE-2024-10977 |
| Ubuntu:22.04:LTS | postgresql-14 | 14.15-0ubuntu0.22.04.1 | USN-7132-1 |
| Ubuntu:22.04:LTS | postgresql-14 | 14.15-0ubuntu0.22.04.1 | UBUNTU-CVE-2024-10977 |
| Ubuntu:24.04:LTS | postgresql-16 | 16.6-0ubuntu0.24.04.1 | UBUNTU-CVE-2024-10977 |
| Ubuntu:24.04:LTS | postgresql-16 | 16.6-0ubuntu0.24.04.1 | USN-7132-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | PostgreSQL | 17 – before 17.116 – before 16.515 – before 15.914 – before 14.1413 – before 13.170 – before 12.21 |
Weakness: CWE-348 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N