CVE-2024-10977

A flaw was found in PostgreSQL's error message handling. This vulnerability allows a Man-in-the-middle attacker to inject arbitrary non-NUL bytes into the libpq application via a server error message.

This vulnerability affects PostgreSQL clients that handle error messages from untrusted servers, which may cause error messages to be misinterpreted as valid query results.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Make sure PostgreSQL is configured to use trusted SSL or GSS settings to prevent untrusted servers from sending error messages. Additionally, when interpreting output from the psql command line interface, make sure to distinguish between error messages and valid data.