Summary
Ein Angreifer kann mehrere Schwachstellen in PostgreSQL JDBC Driver ausnutzen, um Daten zu manipulieren, und um Informationen offenzulegen.
Product
Der PostgreSQL JDBC Driver ermöglicht Java-Anwendungen die Verbindung und Interaktion mit PostgreSQL-Datenbanken.
Vulnerabilities 3
-
Medium 5.9
pgjdbc does not enforce requireAuth when the value excludes every authentication method
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!no…
-
Medium 5.3
pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros)
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the d…
-
Medium 4.2
pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connections
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption (gssEncMode=prefer or require), and the server stores the value with…
Revision history
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-hggc-j2qh-988m vom 2026-10-07 mit PoC
https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hggc-j2qh-988m
-
GitHub Security Advisory GHSA-rhp9-mr79-r74h vom 2026-10-07
https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h
-
GitHub Security Advisory GHSA-f64h-wr5q-3qf3 vom 2026-10-07 mit PoC
https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-f64h-wr5q-3qf3