FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-05-09 22:37:04 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
7a8b6170-a889-11ed-bbae-6cc21735f730	PostgreSQL server -- Client memory disclosure when connecting, with Kerberos, to modified server. PostgreSQL Project reports: A modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. When a libpq client application has a Kerberos credential cache and doesn't explicitly disable option gssencmode, a server can cause libpq to over-read and report an error message containing uninitialized bytes from and following its receive buffer. If libpq's caller somehow makes that message accessible to the attacker, this achieves a disclosure of the over-read bytes. We have not confirmed or ruled out viability of attacks that arrange for a crash or for presence of notable, confidential information in disclosed bytes. Discovery 2023-02-09 Entry 2023-02-09 postgresql15-client < 15.2 postgresql14-client < 14.7 postgresql13-client < 13.10 postgresql12-client < 12.14 CVE-2022-41862 https://www.postgresql.org/support/security/CVE-2022-41862/

VuXML ID

Description

7a8b6170-a889-11ed-bbae-6cc21735f730

PostgreSQL server -- Client memory disclosure when connecting, with Kerberos, to modified server.

PostgreSQL Project reports:

A modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. When a libpq client application has a Kerberos credential cache and doesn't explicitly disable option gssencmode, a server can cause libpq to over-read and report an error message containing uninitialized bytes from and following its receive buffer. If libpq's caller somehow makes that message accessible to the attacker, this achieves a disclosure of the over-read bytes. We have not confirmed or ruled out viability of attacks that arrange for a crash or for presence of notable, confidential information in disclosed bytes.

Discovery 2023-02-09
Entry 2023-02-09
postgresql15-client

< 15.2

postgresql14-client

< 14.7

postgresql13-client

< 13.10

postgresql12-client

< 12.14

CVE-2022-41862
https://www.postgresql.org/support/security/CVE-2022-41862/