Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2026-6478

Опубликовано: 14 мая 2026
Источник: nvd
CVSS3: 6.5
EPSS Низкий

Описание

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
Версия до 14.23 (исключая)
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
Версия от 15.0 (включая) до 15.18 (исключая)
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
Версия от 16.0 (включая) до 16.14 (исключая)
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
Версия от 17.0 (включая) до 17.10 (исключая)
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
Версия от 18.0 (включая) до 18.4 (исключая)

EPSS

Процентиль: 43%
0.00558
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-385

Связанные уязвимости

CVSS3: 6.5
ubuntu
3 месяца назад

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVSS3: 8.2
redhat
3 месяца назад

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVSS3: 6.5
msrc
3 месяца назад

PostgreSQL discloses MD5-hashed passwords via covert timing channel

CVSS3: 6.5
debian
3 месяца назад

Covert timing channel in comparison of MD5-hashed password in PostgreS ...

CVSS3: 6.5
github
3 месяца назад

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

EPSS

Процентиль: 43%
0.00558
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-385