GHSA-hq9p-pm7w-8p54
pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration
At a glance
- Published
- Updated
- CVE
- CVE-2025-49146
- Aliases
- BIT-postgresql-jdbc-driver-2025-49146
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Description
### Impact When the PostgreSQL JDBC driver is configured with channel binding set to `required` (default value is `prefer`), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. ### Patches TBD ### Workarounds Configure `sslMode=verify-full` to prevent MITM attacks. ### References * https://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256 * https://datatracker.ietf.org/doc/html/rfc7677 * https://datatracker.ietf.org/doc/html/rfc5802
Affected packages
| Package | Versions |
|---|---|
| Maven · org.postgresql:postgresql | introduced 42.7.4, fixed 42.7.7 |
References
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-49146 ADVISORY
- https://github.com/pgjdbc/pgjdbc/commit/9217ed16cb2918ab1b6b9258ae97e6ede244d8a0 WEB
- https://datatracker.ietf.org/doc/html/rfc5802 WEB
- https://datatracker.ietf.org/doc/html/rfc7677 WEB
- https://github.com/pgjdbc/pgjdbc PACKAGE
- https://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |