CVE-2024-10977

What it actually does

A PostgreSQL server not validated under SSL or GSS can inject arbitrary non-NUL bytes into error messages returned to libpq clients, allowing the bytes to be interpreted as query output by tools such as psql or screen scrapers.

Why it matters to the business

Organizations running older PostgreSQL versions face a low-probability risk that database query results could be falsified for human operators or automated parsers, potentially leading to incorrect decisions or data mishandling; the large installed base of affected releases increases the window of exposure until upgrades are completed.

How an attack unfolds

An attacker positioned as a man-in-the-middle or operating an untrusted PostgreSQL server sends a crafted, lengthy error message containing arbitrary bytes to a connecting libpq client; the client application displays or processes the message without clear separation from legitimate results, causing a user or downstream script to mistake the injected content for valid query output.

How to fix it

Upgrade PostgreSQL to 17.1, 16.5, 15.9, 14.14, 13.17, or 12.21 or later; apply the corresponding fixed package versions for affected Ubuntu releases (for example 3.13.0-73.116 on Ubuntu 14.04 LTS and 4.3.0-1.10 on Ubuntu 16.04 LTS) and rebuild or redeploy any applications linking against the updated libpq.

How to confirm the fix worked

Verify server version strings match or exceed the fixed releases listed above; test connections with both trusted and untrusted SSL/GSS settings while observing that long error messages no longer appear as undifferentiated text in psql output; confirm the commit 20a82026828536331ebe912b86f060078a173633 is present in source builds.

Typical attack path

1. Attacker intercepts or controls the PostgreSQL server connection
2. Attacker crafts an error message containing arbitrary non-NUL bytes
3. Message is delivered to the libpq client during query processing
4. Client UI or parser presents the message without clear boundary markers
5. Human operator or screen-scraping tool misinterprets the bytes as query results

How to detect it

Review PostgreSQL client logs and psql session transcripts for unusually long or malformed error messages that appear adjacent to query results; examine application logs for unexpected data patterns following database error handling routines; correlate connection attempts from untrusted hosts or without certificate validation.

What your security team should do

• Prioritize upgrade of all PostgreSQL instances to the fixed versions within the next maintenance window
• Audit client applications that parse psql or libpq error output for clear boundary handling
• Enable SSL certificate validation or GSS authentication for all database connections where feasible
• Monitor EPSS trend and threat intelligence feeds for any increase in exploitation activity