Verify that the server constructed the SCRAM nonce correctly. The nonce consists of client and server nonces concatenated together. The client checks the nonce contained the client nonce, but it would get fooled if the server sent a truncated or even empty nonce.
Reported by Steven Fackler to secur...@postgresql.org. Neither me or Steven are sure what harm a malicious server could do with this, but let's fix it. Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/1c9b6e818f047e07f1de62b4d11e0c5db2d55ab7 Modified Files -------------- src/interfaces/libpq/fe-auth-scram.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- Sent via pgsql-committers mailing list (pgsql-committers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-committers
