CVE-2024-10977
MediumSummary
Client use of server error messages in PostgreSQL allows an untrusted server under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. A man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql might misinterpret.
Risk Assessment
A man-in-the-middle attacker could manipulate error messages to deceive users or screen-scrapers, potentially leaking sensitive information.
Recommendation
Update PostgreSQL to the patched version and enforce strong SSL/TLS with certificate verification.
Original NVD description (English source)
Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes