Read the docs
TI-2022-20211 Aliases CVE-2022-41862GHSA-fr68-cm8v-7vv6

Information disclosure in postgresql

Priority LOW 19CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 14 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00622 50th percentileScored 2026-11-07
Fix Partial Red Hat: 12 advisoriesRed Hat: 14 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—postgresqlpostgresql 5.2, postgresql 14.7, postgresql 13.10, postgresql 12.14, postgresql 11.19—No fix listedCNA
  • postgresql Vendor— Affected postgresql 5.2, postgresql 14.7, postgresql 13.10, postgresql 12.14, postgresql 11.19 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*12.0 to before 12.14; 13.0 to before 13.10; 14.0 to before 14.7; 15.0 to before 15.2VulnerablePostgreSQL
cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*8VulnerableFedoraproject
cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:integration_camel_quarkus:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions 12.0 to before 12.14; 13.0 to before 13.10; 14.0 to before 14.7; 15.0 to before 15.2 Vulnerable ·PostgreSQL
  • cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:* Versions 8 Vulnerable ·Fedoraproject
  • cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:integration_camel_quarkus:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat

Remediation

Red Hat 12 advisories

  • RHSA-2023:7772 Released 2023-12-13 · Red Hat rating Important
    rh-postgresql13-postgresql security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-postgresql13-postgresql-13.13-1.el7, rh-postgresql13-postgresql-contrib-13.13-1.el7, rh-postgresql13-postgresql-contrib-syspaths-13.13-1.el7 +12
    • Red Hat Software Collections for RHEL(v. 7) rh-postgresql13-postgresql-13.13-1.el7, rh-postgresql13-postgresql-contrib-13.13-1.el7, rh-postgresql13-postgresql-contrib-syspaths-13.13-1.el7 +12
  • RHSA-2023:7695 Released 2023-12-07 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.aarch64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.ppc64le::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.s390x::postgresql:13 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
  • RHSA-2023:7694 Released 2023-12-07 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.src::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.4.0+11288+c193d6d7.src::postgresql:12 +15
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.aarch64::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.ppc64le::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.s390x::postgresql:12 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.src::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.4.0+11288+c193d6d7.src::postgresql:12 +15
Show 9 more Red Hat advisories
  • RHSA-2023:7666 Released 2023-12-06 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.aarch64::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.s390x::postgresql:12 +47
  • RHSA-2023:7667 Released 2023-12-06 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.src::postgresql:12, pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.2.0+9043+1dbb5661.src::postgresql:12 +15
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.ppc64le::postgresql:12, pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.src::postgresql:12, pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.x86_64::postgresql:12 +29
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.src::postgresql:12, pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.2.0+9043+1dbb5661.src::postgresql:12 +15
  • RHSA-2023:7580 Released 2023-11-29 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13 +47
  • RHSA-2023:7545 Released 2023-11-28 · Red Hat rating Important
    postgresql security update
    • Red Hat CodeReady Linux Builder EUS (v.9.0) postgresql-private-devel-13.13-1.el9_0, postgresql-server-devel-13.13-1.el9_0, postgresql-test-13.13-1.el9_0
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) postgresql-13.13-1.el9_0, postgresql-contrib-13.13-1.el9_0, postgresql-plperl-13.13-1.el9_0 +5
  • RHSA-2023:7016 Released 2023-11-14 · Red Hat rating Low
    libpq security update
    • Red Hat Enterprise Linux AppStream (v. 8) libpq-13.11-1.el8, libpq-devel-13.11-1.el8
  • RHSA-2023:6429 Released 2023-11-07 · Red Hat rating Low
    libpq security update
    • Red Hat Enterprise Linux AppStream (v. 9) libpq-13.11-1.el9, libpq-devel-13.11-1.el9
  • RHSA-2023:4535 Released 2023-08-08 · Red Hat rating Moderate
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.aarch64::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.s390x::postgresql:12 +47
  • RHSA-2023:1693 Released 2023-04-11 · Red Hat rating Moderate
    postgresql security update
    • Red Hat CodeReady Linux Builder (v. 9) postgresql-docs-13.10-1.el9_1, postgresql-private-devel-13.10-1.el9_1, postgresql-server-devel-13.10-1.el9_1 +3
    • Red Hat Enterprise Linux AppStream (v. 9) postgresql-13.10-1.el9_1, postgresql-contrib-13.10-1.el9_1, postgresql-plperl-13.10-1.el9_1 +5
  • RHSA-2023:1576 Released 2023-04-04 · Red Hat rating Moderate
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13 +47

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat CodeReady Linux Builder (v. 9)Fixed RHSA-2023:1693
Red Hat CodeReady Linux Builder EUS (v.9.0)Fixed RHSA-2023:7545
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:1576, RHSA-2023:4535, RHSA-2023:7016
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:1693, RHSA-2023:6429
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2023:7667
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2023:7694, RHSA-2023:7695
Red Hat Enterprise Linux AppStream E4S (v. 8.2)Fixed RHSA-2023:7667
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2023:7694, RHSA-2023:7695
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:7580, RHSA-2023:7666
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2023:7545
Red Hat Enterprise Linux AppStream TUS (v. 8.2)Fixed RHSA-2023:7667
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2023:7694, RHSA-2023:7695
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2023:7772
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2023:7772
Not affected: 9 products
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat Single Sign-On 7
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41862
  2. 2026-10-03 Alias added: GHSA-fr68-cm8v-7vv6
  3. 2026-11-07 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences