QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2024-10977

Back to search

CVE-2024-10977

Published: Nov 14, 2024

Modified: Nov 3, 2025

PUBLISHED

CVSS v3.1

3.1

LOW

Description

Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

VendorProductVersions

n/a

PostgreSQL

affected
17 - < 17.1
affected
16 - < 16.5
affected
15 - < 15.9
affected
14 - < 14.14
affected
13 - < 13.17

+1 more versions

Weaknesses (CWE)

CWE-348

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now