CVE-2022-41862

Published: Mar 3, 2023Modified: Jun 17, 2026

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.2 / Impact: 1.4

Source: NVD

Description

In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.

Affected (9)

Products: Postgresql: Postgresql · Fedoraproject: Fedora · Redhat: Enterprise Linux, Integration Camel K, Integration Camel Quarkus, Integration Service Registry

1 product

1 product

4 products

Integration Camel Quarkus

Integration Service Registry

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Postgresql Postgresql	12.0 ≤ version < 12.14
Postgresql Postgresql	13.0 ≤ version < 13.10
Postgresql Postgresql	14.0 ≤ version < 14.7
Postgresql Postgresql	15.0 ≤ version < 15.2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 8

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Integration Camel K	All versions
Redhat Integration Camel Quarkus	All versions
Redhat Integration Service Registry	All versions