{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2025-12818: libpq: guard allocation size computations against int/size_t\n wraparound (undersized allocation, out-of-bounds write)\n- CVE-2024-10977: libpq: do not show an error message received during SSL\n negotiation, since the server is not authenticated yet\n- CVE-2025-4207: with GB18030, do not read past the end of unterminated input\n when determining a character's length (libpq escape functions, convert())", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793317311", "url": "https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793317311" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_postgresql/el7/advisories/2026/clsa-2026_1793317311.json" } ], "tracking": { "current_release_date": "2026-10-29T23:42:43Z", "generator": { "date": "2026-10-29T23:42:43Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1793317311", "initial_release_date": "2026-10-29T23:42:43Z", "revision_history": [ { "date": "2026-10-29T23:42:43Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "postgresql96: Fix of 3 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 7", "product": { "name": "Community Enterprise Operating System 7", "product_id": "CentOS-7", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product": { "name": "postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_id": "postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-docs@9.6.24-1PGDG.1.el7.tuxcare.els10?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product": { "name": "postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_id": "postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-plperl@9.6.24-1PGDG.1.el7.tuxcare.els10?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product": { "name": "postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_id": "postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-devel@9.6.24-1PGDG.1.el7.tuxcare.els10?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product": { "name": "postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_id": "postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-contrib@9.6.24-1PGDG.1.el7.tuxcare.els10?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product": { "name": "postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_id": "postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-plpython3@9.6.24-1PGDG.1.el7.tuxcare.els10?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product": { "name": "postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_id": "postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-test@9.6.24-1PGDG.1.el7.tuxcare.els10?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product": { "name": "postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_id": "postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-pltcl@9.6.24-1PGDG.1.el7.tuxcare.els10?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product": { "name": "postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_id": "postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-server@9.6.24-1PGDG.1.el7.tuxcare.els10?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product": { "name": "postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_id": "postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96@9.6.24-1PGDG.1.el7.tuxcare.els10?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product": { "name": "postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_id": "postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-plpython@9.6.24-1PGDG.1.el7.tuxcare.els10?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product": { "name": "postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_id": "postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-libs@9.6.24-1PGDG.1.el7.tuxcare.els10?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" }, "product_reference": "postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" }, "product_reference": "postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" }, "product_reference": "postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" }, "product_reference": "postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" }, "product_reference": "postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" }, "product_reference": "postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" }, "product_reference": "postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" }, "product_reference": "postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" }, "product_reference": "postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" }, "product_reference": "postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" }, "product_reference": "postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "relates_to_product_reference": "CentOS-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-4207", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "description", "text": "Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are affected.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-postgresql/cve/CVE-2025-4207" }, { "category": "external", "summary": "https://www.postgresql.org/support/security/CVE-2025-4207/", "url": "https://www.postgresql.org/support/security/CVE-2025-4207/" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2025/05/09/3", "url": "http://www.openwall.com/lists/oss-security/2025/05/09/3" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00011.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00011.html" } ], "release_date": "2025-05-08T15:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-29T23:41:52.538237Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793317311", "product_ids": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" ], "url": "https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793317311" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2025-12818", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-postgresql/cve/CVE-2025-12818" }, { "category": "external", "summary": "https://www.postgresql.org/support/security/CVE-2025-12818/", "url": "https://www.postgresql.org/support/security/CVE-2025-12818/" } ], "release_date": "2025-11-13T13:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-29T23:41:52.538237Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793317311", "product_ids": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" ], "url": "https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793317311" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-10977", "cwe": { "id": "CWE-348", "name": "Use of Less Trusted Source" }, "notes": [ { "category": "description", "text": "Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-postgresql/cve/CVE-2024-10977" }, { "category": "external", "summary": "https://www.postgresql.org/support/security/CVE-2024-10977/", "url": "https://www.postgresql.org/support/security/CVE-2024-10977/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html", "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html" } ], "release_date": "2024-11-14T13:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-29T23:41:52.538237Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793317311", "product_ids": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" ], "url": "https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793317311" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ] } ] }