Read the docs
TI-2024-10175 Aliases CVE-2024-10977GHSA-62q4-hc79-94qj

PostgreSQL libpq retains an error message from man-in-the-middle

Priority LOW 18CWE-348Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-345.

Summary

Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00398 34th percentileScored 2026-11-07
Fix Partial PostgreSQL: 17.1, 16.5, 15.9 +3Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—PostgreSQL17 to before 17.1; 16 to before 16.5; 15 to before 15.9; 14 to before 14.14; 13 to before 13.17; before 12.2117.1, 16.5, 15.9, 14.14, 13.17, 12.21Patch availableCNA
  • PostgreSQL Vendor— Affected 17 to before 17.1; 16 to before 16.5; 15 to before 15.9; 14 to before 14.14; 13 to before 13.17; before 12.21 Fixed in 17.1, 16.5, 15.9, 14.14, 13.17, 12.21 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*12.0 to before 12.21; 13.0 to before 13.17; 14.0 to before 14.14; 15.0 to before 15.9; 16.0 to before 16.5VulnerablePostgreSQL
cpe:2.3:a:postgresql:postgresql:17.0:-:*:*:*:*:*:*17.0VulnerablePostgreSQL
cpe:2.3:a:postgresql:postgresql:17.0:beta1:*:*:*:*:*:*17.0 beta1VulnerablePostgreSQL
cpe:2.3:a:postgresql:postgresql:17.0:beta2:*:*:*:*:*:*17.0 beta2VulnerablePostgreSQL
cpe:2.3:a:postgresql:postgresql:17.0:beta3:*:*:*:*:*:*17.0 beta3VulnerablePostgreSQL
cpe:2.3:a:postgresql:postgresql:17.0:rc1:*:*:*:*:*:*17.0 rc1VulnerablePostgreSQL
  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions 12.0 to before 12.21; 13.0 to before 13.17; 14.0 to before 14.14; 15.0 to before 15.9; 16.0 to before 16.5 Vulnerable ·PostgreSQL
  • cpe:2.3:a:postgresql:postgresql:17.0:-:*:*:*:*:*:* Versions 17.0 Vulnerable ·PostgreSQL
  • cpe:2.3:a:postgresql:postgresql:17.0:beta1:*:*:*:*:*:* Versions 17.0 beta1 Vulnerable ·PostgreSQL
  • cpe:2.3:a:postgresql:postgresql:17.0:beta2:*:*:*:*:*:* Versions 17.0 beta2 Vulnerable ·PostgreSQL
  • cpe:2.3:a:postgresql:postgresql:17.0:beta3:*:*:*:*:*:* Versions 17.0 beta3 Vulnerable ·PostgreSQL
  • cpe:2.3:a:postgresql:postgresql:17.0:rc1:*:*:*:*:*:* Versions 17.0 rc1 Vulnerable ·PostgreSQL

Remediation

  • Fix · CNA PostgreSQL Fixed in 17.1, 16.5, 15.9, 14.14, 13.17, 12.21

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PostgreSQL 12.21, 13.17 and 4 more versions

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2024-10177 PostgreSQL PL/Perl environment variable changes execute arbitrary codePriority MEDIUM 47
    • TI-2024-10174 PostgreSQL row security below e.g. subqueries disregards user ID changesPriority LOW 26
    • TI-2024-10176 PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user IDPriority LOW 21
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10977
  2. 2026-10-03 Alias added: GHSA-62q4-hc79-94qj

References

Advisory 1

  • TI-2019-06651 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and… CVSS 3.0HIGH 7.2
  • TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
  • TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8
  • TI-2013-01675 Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9… CVSS 2.0MEDIUM 6.5
  • TI-2007-03176 The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE… CVSS 2.0HIGH 9.0
  • TI-2022-01423 SQL injection in postgresql CVSS 3.1HIGH 8.8
See all 202 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences