Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 11 | pgbouncer | 1.15.0-1+deb11u1 |
Vulnerabilities 2
-
High 8.1
PgBouncer default auth_query does not take Postgres password expiry into account
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password
-
Unscored —
When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL querie…