CVE-2024-10977: PostgreSQL Information Disclosure Flaw

CVE-2024-10977 Overview

CVE-2024-10977 is an information disclosure vulnerability affecting the PostgreSQL libpq client library. The vulnerability allows a server that is not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application through error messages. This enables man-in-the-middle attackers to send crafted long error messages that users of psql or screen-scraper applications may mistake for valid query results, potentially leading to information confusion and deception.

Critical Impact

Attackers in a man-in-the-middle position can inject misleading content into PostgreSQL client sessions by spoofing error messages, potentially causing users to misinterpret malicious data as legitimate query results.

Affected Products

• PostgreSQL versions before 17.1
• PostgreSQL versions before 16.5
• PostgreSQL versions before 15.9
• PostgreSQL versions before 14.14
• PostgreSQL versions before 13.17
• PostgreSQL versions before 12.21
• PostgreSQL 17.0 (including beta and RC releases)

Discovery Timeline

• 2024-11-14 - CVE-2024-10977 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-10977

Vulnerability Analysis

This vulnerability exists in the PostgreSQL libpq client library's handling of server error messages. When a client establishes a connection to a PostgreSQL server, the library processes error messages returned by the server without adequate validation of the message source's trustworthiness. In scenarios where SSL or GSS security settings are not properly enforced, an untrusted server (or an attacker impersonating a legitimate server) can send arbitrary content embedded within error messages.

The impact is primarily relevant to command-line tools like psql and automated screen-scraping applications where the boundary between error messages and legitimate query output may not be clearly delineated in the user interface. Client applications with unambiguous UI indicators separating error messages from query results are less affected by this vulnerability.

Root Cause

The root cause stems from insufficient source verification (CWE-348: Use of Less Trusted Source) and improper verification of message authenticity (CWE-345: Insufficient Verification of Data Authenticity). The libpq library accepts and displays error messages from servers without adequately verifying that the server is trusted under the current security configuration. This allows untrusted entities to inject arbitrary content into the client's display output through the error message channel.

Attack Vector

The attack requires a network-based man-in-the-middle position between the PostgreSQL client and the intended server. The attacker intercepts the connection attempt and responds with crafted error messages containing arbitrary content designed to mimic valid query results.

The attack scenario involves:

1. The attacker positions themselves to intercept network traffic between a PostgreSQL client and server
2. When the client initiates a connection, the attacker responds as a rogue server
3. The attacker sends specially crafted error messages containing content that resembles legitimate query output
4. Users viewing the output in psql or screen-scraping tools may interpret the malicious content as valid data

This attack is particularly effective against environments where SSL certificate validation is not strictly enforced or where GSS authentication is misconfigured.

Detection Methods for CVE-2024-10977

Indicators of Compromise

• Unusual or unexpectedly long error messages from PostgreSQL servers
• Error messages containing content that resembles valid query result formatting
• Network traffic anomalies indicating potential man-in-the-middle interception on PostgreSQL connections (default port 5432)
• SSL/TLS certificate warnings or unexpected certificate changes for database connections

Detection Strategies

• Monitor network traffic for signs of connection interception or rogue server responses on PostgreSQL ports
• Implement strict SSL certificate validation and alert on certificate mismatches or untrusted certificates
• Review client application logs for unusual error message patterns or unexpected content in error outputs
• Deploy network intrusion detection systems (NIDS) to identify potential MITM attack patterns

Monitoring Recommendations

• Enable comprehensive logging on PostgreSQL client connections including SSL/GSS negotiation events
• Implement network-level monitoring for anomalous PostgreSQL protocol traffic
• Configure alerts for SSL certificate validation failures in database connection attempts
• Regularly audit client-side configuration to ensure proper security settings are enforced

How to Mitigate CVE-2024-10977

Immediate Actions Required

• Upgrade PostgreSQL to patched versions: 17.1, 16.5, 15.9, 14.14, 13.17, or 12.21
• Enforce strict SSL verification mode (sslmode=verify-full) for all PostgreSQL client connections
• Ensure proper GSS authentication configuration where applicable
• Review and harden network security to prevent man-in-the-middle positioning

Patch Information

PostgreSQL has released security updates addressing this vulnerability. Organizations should upgrade to the following fixed versions based on their current major version:

For detailed patch information, refer to the PostgreSQL Security Advisory and the Debian LTS Announcement.

Workarounds

• Configure sslmode=verify-full in libpq connection strings to enforce strict SSL certificate validation
• Use client applications that clearly delineate error messages from query results in the user interface
• Implement network segmentation to reduce exposure to man-in-the-middle attacks
• Deploy TLS inspection at network boundaries to detect rogue server certificates

# Configuration example - enforce strict SSL in libpq connection
# Set environment variable for all PostgreSQL client connections
export PGSSLMODE=verify-full
export PGSSLROOTCERT=/path/to/root/ca/certificate.crt

# Or specify in connection string
psql "host=db.example.com dbname=mydb sslmode=verify-full sslrootcert=/path/to/ca.crt"