Source: pgpool2 Version: 4.7.2-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for pgpool2. CVE-2026-92867[0]: | An out-of-bounds write vulnerability exists in Pgpool-II , which may | allow an authenticated attacker to cause abnormal process | termination or arbitrary code execution. CVE-2026-92868[1]: | An improper certificate validation vulnerability exists in Pgpool- | II, which may allow an unauthenticated attacker to bypass client | certificate authentication. CVE-2026-92869[2]: | An out-of-bounds write vulnerability exists in Pgpool-II, which may | allow an authenticated attacker to cause abnormal process | termination. CVE-2026-92870[3]: | A stack-based buffer overflow vulnerability exists in Pgpool-II, | which may allow an unauthenticated attacker to cause abnormal | process termination. CVE-2026-92871[4]: | A NULL pointer dereference vulnerability exists in Pgpool-II, which | may allow an unauthenticated attacker to cause abnormal termination | of the watchdog process. CVE-2026-92872[5]: | Pgpool-II inserts sensitive information into log file, which may | allow an authenticated attacker to obtain the cluster information. CVE-2026-92873[6]: | Pgpool-II contains an incorrect implementation of an authentication | algorithm, which may allow an unauthenticated attacker to promote an | arbitrary watchdog node to the leader node. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-92867 https://www.cve.org/CVERecord?id=CVE-2026-92867 [1] https://security-tracker.debian.org/tracker/CVE-2026-92868 https://www.cve.org/CVERecord?id=CVE-2026-92868 [2] https://security-tracker.debian.org/tracker/CVE-2026-92869 https://www.cve.org/CVERecord?id=CVE-2026-92869 [3] https://security-tracker.debian.org/tracker/CVE-2026-92870 https://www.cve.org/CVERecord?id=CVE-2026-92870 [4] https://security-tracker.debian.org/tracker/CVE-2026-92871 https://www.cve.org/CVERecord?id=CVE-2026-92871 [5] https://security-tracker.debian.org/tracker/CVE-2026-92872 https://www.cve.org/CVERecord?id=CVE-2026-92872 [6] https://security-tracker.debian.org/tracker/CVE-2026-92873 https://www.cve.org/CVERecord?id=CVE-2026-92873 [7] https://pgpool.net/news/2026-09-29/ Please adjust the affected versions in the BTS as needed. Regards, Salvatore
