security/vulxml: Add entry for PostgreSQL JDBC Driver

2026-05-22 18:42:42 -07:00 · 2025-06-12 08:55:28 +02:00
parent a6905187ca
commit 47f0fcd2cc
1 changed files with 38 additions and 0 deletions
@@ -1,3 +1,41 @@
+  <vuln vid="2a220a73-4759-11f0-a44a-6cc21735f730">
+    <topic>PostgreSQL JDBC library -- Improper Authentication</topic>
+    <affects>
+      <package>
+	<name>postgresql-jdbc</name>
+	<range><lt>42.7.7</lt></range>
+      </package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>PostgreSQL JDBC Driver project reports:</p>
+	<blockquote cite="https://jdbc.postgresql.org/changelogs/2025-06-11-42"/>
+	<p>
+                Client Allows Fallback to Insecure Authentication Despite
+                channelBinding=require configuration. Fix channel binding
+                required handling to reject non-SASL authentication Previously,
+                when channel binding was set to "require", the driver
+                would silently ignore this requirement for non-SASL
+                authentication methods. This could lead to a false sense of
+                security when channel binding was explicitly requested but not
+                actually enforced. The fix ensures that when channel binding is
+                set to "require", the driver will reject connections that use
+                non-SASL authentication methods or when SASL authentication has
+                not completed properly.
+        </p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2025-49146</cvename>
+      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-49146</url>
+    </references>
+    <dates>
+      <discovery>2025-06-12</discovery>
+      <entry>2025-06-12</entry>
+    </dates>
+  </vuln>
+
  <vuln vid="fa1d42c8-42fe-11f0-a9fa-b42e991fc52e">
    <topic>ModSecurity -- possible DoS vulnerability</topic>
    <affects>