Low: libpq security update
Summary
ALSA-2023:7016: Low: libpq security update. Affects libpq versions < 13.11-1.el8.alma.1. Fixed in 13.11-1.el8.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The libpq package is the PostgreSQL client library used by client programs to connect to PostgreSQL servers. It provides functionality for establishing connections, executing queries, and managing transactions. The package is an integral part of the AlmaLinux 8 ecosystem.
Vulnerability Detail
The vulnerability (CVE-2022-41862) in libpq allows for client memory disclosure when connecting with Kerberos to a modified server. This can potentially lead to the exposure of sensitive information, such as authentication credentials or other data stored in memory. The impact of this vulnerability is dependent on the specific usage of libpq and the sensitivity of the data being processed.
How To Fix
Minimum fixed version
13.11-1.el8.alma.1
This is the first release that contains the fix.
sudo dnf update libpqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating the libpq package to the fixed version is the recommended solution.
Conclusion
The libpq package in AlmaLinux 8 is vulnerable to a memory disclosure issue when connecting with Kerberos to a modified server. To mitigate this vulnerability, it is crucial to update the libpq package to version 13.11-1.el8.alma.1 or later. No known workarounds exist for this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libpq →
FAQ
libpq is the PostgreSQL client library used for connecting to PostgreSQL servers and performing database operations.
The vulnerability can result in the disclosure of client memory, potentially exposing sensitive information stored in memory.
You can check the version of libpq installed by running the command 'rpm -q libpq' on AlmaLinux 8.
There is no known exploit for this vulnerability at the time of this advisory.
The libpq-devel package is also affected by this vulnerability. It is recommended to update both libpq and libpq-devel to the fixed versions.
Related vulnerabilities
Recent vulnerabilities recorded for libpq.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
