CVSROOT: /cvs
Module name: ports
Changes by: [email protected] 2026/09/29 02:11:21
Modified files:
databases/pgbouncer: Makefile distinfo
databases/pgbouncer/patches: patch-etc_pgbouncer_ini
Removed files:
databases/pgbouncer/patches: patch-lib_usual_tls_tls_compat_c
patch-lib_usual_tls_tls_conninfo_c
Log message:
databases/pgbouncer: security update to 1.26.0
see https://www.pgbouncer.org/2026/09/pgbouncer-1-26-0, fixes:
* CVE-2026-19888: DoS due to crash, triggerable by unauthenticated
clients. Caused by a SCRAM client-final-message without a nonce.
* CVE-2026-6668: DoS due to infinite loop, triggerable by unauthenticated
clients. Caused by an integer overflow in the packet buffer growth
logic.
* CVE-2026-6669: DoS due to unbounded work during login, triggerable by a
malicious PostgreSQL server. Caused by an unbounded SCRAM iteration
count.
ok naddy@
