Описание
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| pgbouncer | fixed | 1.25.1-1 | package | |
| pgbouncer | fixed | 1.24.1-1+deb13u1 | trixie | package |
| pgbouncer | fixed | 1.18.0-1+deb12u1 | bookworm | package |
Примечания
https://www.pgbouncer.org/changelog.html#pgbouncer-125x
Fixed by: https://github.com/pgbouncer/pgbouncer/commit/85acffac5ddf56657706812f600c5f7f477abbab (pgbouncer_1_25_1)
EPSS
Связанные уязвимости
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
Untrusted search path in auth_query connection in PgBouncer
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.0 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
EPSS