Bug 900759 (CVE-2022-41862)

Summary:	<dev-db/postgresql-{11.19,12.14,13.10,14.7,15.2}: client buffer overread
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	pgsql-bugs
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://www.postgresql.org/support/security/CVE-2022-41862/
Whiteboard:	B4 [noglsa]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2023-03-11 03:38:58 UTC

CVE-2022-41862:

In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.

Please stabilize fixed versions.