PostgreSQL Server Error Message Vulnerability Affects Multiple Versions
CVE-2024-10977

3.1LOW

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
14 November 2024

What is CVE-2024-10977?

A vulnerability in PostgreSQL allows a compromised server, when using inadequate SSL or GSS settings, to serve arbitrary non-NUL bytes to the libpq application. This can mislead users or automated scripts into thinking that they received valid query results instead of error messages. Particularly in environments where the user interface does not clearly delineate between error messages and other text, this could lead to confusion and potentially exploit opportunities for attackers. Affected versions include those earlier than PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

PostgreSQL 17 < 17.1

PostgreSQL 16 < 16.5

PostgreSQL 15 < 15.9

References

https://www.postgresql.org/support/security/CVE-2024-10977/

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.