Описание
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
A flaw was found in PgBouncer. Missing validation of a mandatory attribute in the SCRAM client-final-message parser allows an unauthenticated remote attacker to crash the process. By sending a malformed message, the parser can report success while a required value remains unset, leading to a NULL pointer dereference. This crash occurs before any credentials are verified and terminates all pooled connections, resulting in a Denial of Service.
Отчет
This vulnerability is rated as Important severity because an unauthenticated remote network client can crash the connection pooler daemon before authentication completes, resulting in a complete denial of service across all active database sessions. In typical Red Hat environments running PgBouncer, the service manages client connections for PostgreSQL within a single shared daemon, meaning any unexpected termination drops every existing and pending database transaction. While exploitation does not require valid database credentials, the risk is limited to service availability denial without enabling code execution or data leakage, and impact is confined to environments where untrusted network traffic can reach the pooling listener.
Меры по смягчению последствий
To mitigate this issue, restrict network access to the PgBouncer service to only trusted clients or localhost. This can be achieved by configuring firewall rules to limit incoming connections to the PgBouncer port or by setting the listen_addr parameter in the pgbouncer.ini configuration file to localhost or specific trusted IP addresses. After modifying the pgbouncer.ini file, the PgBouncer service must be restarted for the changes to take effect, which will temporarily disrupt existing connections.
Example for pgbouncer.ini:
Example for firewall (adjust port if necessary, default is 6432):
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer
Missing validation of a mandatory attribute in the SCRAM client-final- ...
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection.
EPSS
7.5 High
CVSS3