Bug 2165722 (CVE-2022-41862)

Summary: CVE-2022-41862 postgresql: Client memory disclosure when connecting with Kerberos to modified server
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: aileenc, alampare, alazarot, anstephe, avibelli, balejosg, bgeorges, boliveir, caolanm, caswilli, chazlett, clement.escoffier, dandread, databases-maint, dhanak, dkreling, emingora, eric.wittmann, fjanus, fmongiar, ggastald, gjospin, gmalinko, gsmet, hamadhan, hbraun, hhorak, ibek, janstey, jmartisk, jnethert, jorton, jpavlik, jrokos, jwon, kaycoth, kverlaen, kyoshida, lbacciot, lthon, max.andersen, mnovotny, pantinor, pdelbell, pdrozd, peholase, pgallagh, pjindal, pkubat, praiskup, probinso, pskopek, rguimara, rrajasek, rruss, rsvoboda, sbiarozk, sdouglas, security-response-team, sthorger, tqvarnst, zmiklank
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: postgresql 5.2, postgresql 14.7, postgresql 13.10, postgresql 12.14, postgresql 11.19 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found In PostgreSQL. A modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions, a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2023-04-11 19:36:02 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2165882, 2165883, 2165884, 2170071, 2171365, 2171366, 2171367, 2171368, 2171369, 2171370, 2173998, 2174356, 2225251, 2249521    
Bug Blocks: 2165723, 2165725    

Description Pedro Sampaio 2023-01-30 20:54:18 UTC 
A modified, unauthenticated server can send an unterminated string during the
establishment of Kerberos transport encryption. When a libpq client
application has a Kerberos credential cache and doesn't explicitly disable
option "gssencmode", a server can cause libpq to over-read and report an error
message containing uninitialized bytes from and following its receive buffer.
If libpq's caller somehow makes that message accessible to the attacker, this
achieves a disclosure of the over-read bytes. We have not confirmed or ruled
out viability of attacks that arrange for a crash or for presence of notable,
confidential information in disclosed bytes.
Comment 4 Dhananjay Arunesh 2023-02-15 15:07:04 UTC 
Created postgresql-jdbc tracking bugs for this issue:

Affects: fedora-all [bug 2170071]
Comment 8 errata-xmlrpc 2023-04-04 09:46:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:1576 https://access.redhat.com/errata/RHSA-2023:1576
Comment 9 errata-xmlrpc 2023-04-11 14:24:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:1693 https://access.redhat.com/errata/RHSA-2023:1693
Comment 10 Product Security DevOps Team 2023-04-11 19:35:58 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-41862
Comment 13 errata-xmlrpc 2023-08-08 08:37:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4535 https://access.redhat.com/errata/RHSA-2023:4535
Comment 14 errata-xmlrpc 2023-11-07 08:16:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6429 https://access.redhat.com/errata/RHSA-2023:6429
Comment 20 errata-xmlrpc 2023-11-14 15:18:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:7016 https://access.redhat.com/errata/RHSA-2023:7016
Comment 21 errata-xmlrpc 2023-11-28 15:08:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:7545 https://access.redhat.com/errata/RHSA-2023:7545
Comment 22 errata-xmlrpc 2023-11-29 14:10:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:7580 https://access.redhat.com/errata/RHSA-2023:7580
Comment 25 errata-xmlrpc 2023-12-06 09:47:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2023:7667 https://access.redhat.com/errata/RHSA-2023:7667
Comment 26 errata-xmlrpc 2023-12-06 09:48:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:7666 https://access.redhat.com/errata/RHSA-2023:7666
Comment 27 errata-xmlrpc 2023-12-07 08:20:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2023:7694 https://access.redhat.com/errata/RHSA-2023:7694
Comment 28 errata-xmlrpc 2023-12-07 08:20:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2023:7695 https://access.redhat.com/errata/RHSA-2023:7695
Comment 29 errata-xmlrpc 2023-12-13 08:02:40 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2023:7772 https://access.redhat.com/errata/RHSA-2023:7772