This is an automated email from the ASF dual-hosted git repository. reshke pushed a commit to branch backport_cve in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit ed048bcf28683e02ce958574df2826d6a2ca5a70 Author: Nathan Bossart <[email protected]> AuthorDate: Mon Aug 10 06:38:24 2026 -0700 Use value of scram_iterations in mock_scram_secret(). Presently, mock_scram_secret() always uses SCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable response discrepancy hazard when scram_iterations is set to something else. To fix, use the value of the configuration parameter instead, and document that unauthenticated users can discover the existence of roles with passwords created with different iteration counts. Reported-by: Radim Marek <[email protected]> Author: Nathan Bossart <[email protected]> Reviewed-by: Michael Paquier <[email protected]> Reviewed-by: Heikki Linnakangas <[email protected]> Reviewed-by: Jacob Champion <[email protected]> Security: CVE-2026-14672 Backpatch-through: 16 --- doc/src/sgml/config.sgml | 13 +++++++++++++ src/backend/libpq/auth-scram.c | 2 +- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 1aaa29b9c4d..3b8b60d9347 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -1136,6 +1136,19 @@ include_dir 'conf.d' time of encryption. In order to make use of a changed value, a new password must be set. </para> + <note> + <para> + If a role password was created with a different iteration count than + the value of <literal>scram_iterations</literal> specified in the + <filename>postgresql.conf</filename> file or on the server command + line, an unauthenticated user can discern the existence of the role by + observing discrepancies in the server's responses to connection + attempts. If you find this concerning, ensure that all role passwords + are created with <literal>scram_iterations</literal> set to the value + specified in the <filename>postgresql.conf</filename> file or on the + server command line. + </para> + </note> </listitem> </varlistentry> diff --git a/src/backend/libpq/auth-scram.c b/src/backend/libpq/auth-scram.c index 1b9e1cc0cc1..ce9f4ba5eb8 100644 --- a/src/backend/libpq/auth-scram.c +++ b/src/backend/libpq/auth-scram.c @@ -722,7 +722,7 @@ mock_scram_secret(const char *username, pg_cryptohash_type *hash_type, encoded_salt[encoded_len] = '\0'; *salt = encoded_salt; - *iterations = SCRAM_SHA_256_DEFAULT_ITERATIONS; + *iterations = scram_sha_256_iterations; /* StoredKey and ServerKey are not used in a doomed authentication */ memset(stored_key, 0, SCRAM_MAX_KEY_LEN); --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
