Описание
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
A flaw was found in PostgreSQL. This vulnerability, a covert timing channel, exists in the comparison of MD5-hashed passwords during authentication. A remote attacker could exploit this to recover user credentials, gaining unauthorized access to the database. This issue specifically impacts databases that retain MD5-hashed passwords from upgrades of PostgreSQL 13 or earlier.
Меры по смягчению последствий
To mitigate this vulnerability, ensure that all PostgreSQL user passwords are not hashed using MD5. Users should migrate to stronger hashing algorithms such as scram-sha-256. This can be achieved by altering user passwords, which will automatically update their hash to the currently configured default. For example, to change a user's password: ALTER USER username WITH PASSWORD 'new_password'; This action will require users to re-authenticate. If a service relies on these credentials, it may require a restart to pick up the new authentication details.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | postgresql | Out of support scope | ||
| Red Hat Enterprise Linux 7 | postgresql | Affected | ||
| Red Hat Enterprise Linux 8 | postgresql | Not affected | ||
| Red Hat Enterprise Linux 8 | postgresql-jdbc | Not affected | ||
| Self-service automation portal 2 | ansible-automation-platform/bootc-automation-portal-rhel9 | Affected | ||
| Red Hat Enterprise Linux 10 | postgresql18 | Fixed | RHSA-2026:27742 | 22.06.2026 |
| Red Hat Enterprise Linux 10 | postgresql16 | Fixed | RHSA-2026:27743 | 22.06.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | postgresql16 | Fixed | RHSA-2026:27718 | 22.06.2026 |
| Red Hat Enterprise Linux 8 | postgresql | Fixed | RHSA-2026:26181 | 16.06.2026 |
| Red Hat Enterprise Linux 8 | libpq | Fixed | RHSA-2026:27738 | 22.06.2026 |
Показывать по
Дополнительная информация
Статус:
8.2 High
CVSS3
Связанные уязвимости
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
PostgreSQL discloses MD5-hashed passwords via covert timing channel
Covert timing channel in comparison of MD5-hashed password in PostgreS ...
8.2 High
CVSS3