Source: libpgjava X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerabilities were published for libpgjava. CVE-2026-107315[0]: | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 | pads a value that is shorter than its declared length with bytes | left in its send buffer instead of zeros, and the server stores | those bytes as part of the value. The bytes are messages the driver | sent earlier on the same connection: SQL text and parameter values | of recent statements, which on a pooled connection can come from | other requests. Each padded value can carry up to 8192 bytes of this | traffic, or 16320 bytes on a connection with GSS encryption. The | padding happens when an application declares a length larger than | the data it supplies, through PreparedStatement.setObject with a | ByteStreamWriter, CopyIn.writeToCopy, PGCopyOutputStream.write, | LargeObject.write, or Blob.setBytes. The driver accepts these calls | without an error. An attacker who can make the application store | such a value and read it back can collect earlier traffic. | Applications whose declared lengths always match their data are not | affected. Versions 42.7.3 and earlier pad with zeros. https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-f64h-wr5q-3qf3 https://github.com/pgjdbc/pgjdbc/commit/c8998c8e9632a7cdecb128dd7cd122d330b3598a (REL42.7.14) CVE-2026-107314[1]: | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 | enforce no restriction when the requireAuth connection property | excludes all six authentication methods the driver knows, for | example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. | The driver then accepts any method the server asks for, including | cleartext password authentication. A value without a method in it, | such as requireAuth=, (a single comma), is affected the same way. An | attacker positioned between the application and its server can ask | for cleartext password authentication and receive the database | password. A positive list such as requireAuth=scram-sha-256, and a | partial exclusion such as requireAuth=!password,!md5, are enforced | correctly. The property has no default value, so a deployment that | does not set it is not affected. 42.7.14 fixes the problem: such a | connection is refused with SQLState 08004, and a value without a | method in it is rejected as invalid. https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h https://github.com/pgjdbc/pgjdbc/commit/a65ef98fe37bf0ecbd1a6331205cdb924985ed75 (REL42.7.14) If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-107315 https://www.cve.org/CVERecord?id=CVE-2026-107315 [1] https://security-tracker.debian.org/tracker/CVE-2026-107314 https://www.cve.org/CVERecord?id=CVE-2026-107314 Please adjust the affected versions in the BTS as needed.
